github - ghsa-vxgf-qp88-w686

ghsa-vxgf-qp88-w686

Vulnerability from github

Published

2022-05-17 02:29

Modified

2022-05-17 02:29

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-0377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-02T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.",
  "id": "GHSA-vxgf-qp88-w686",
  "modified": "2022-05-17T02:29:30Z",
  "published": "2022-05-17T02:29:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0377"
    },
    {
      "type": "WEB",
      "url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    },
    {
      "type": "WEB",
      "url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
    },
    {
      "type": "WEB",
      "url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/CVE-2017-0377"
    },
    {
      "type": "WEB",
      "url": "https://trac.torproject.org/projects/tor/ticket/22753"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

cve-2017-0377

Vulnerability from cvelistv5

Published

2017-07-02 15:00

Modified

2024-08-05 13:03

Severity ?

Summary

References

▼	URL	Tags
	https://trac.torproject.org/projects/tor/ticket/22753	x_refsource_CONFIRM
	https://security-tracker.debian.org/CVE-2017-0377	x_refsource_CONFIRM
	https://blog.torproject.org/blog/tor-0309-released-security-update-clients	x_refsource_CONFIRM
	https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients	x_refsource_CONFIRM
	https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

n/a

Tor

Version: Tor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:03:56.989Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://trac.torproject.org/projects/tor/ticket/22753"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/CVE-2017-0377"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Tor",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Tor"
            }
          ]
        }
      ],
      "datePublic": "2017-07-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "privacy bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-02T14:57:01",
        "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
        "shortName": "debian"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://trac.torproject.org/projects/tor/ticket/22753"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security-tracker.debian.org/CVE-2017-0377"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@debian.org",
          "ID": "CVE-2017-0377",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Tor",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Tor"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay\u0027s family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "privacy bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://trac.torproject.org/projects/tor/ticket/22753",
              "refsource": "CONFIRM",
              "url": "https://trac.torproject.org/projects/tor/ticket/22753"
            },
            {
              "name": "https://security-tracker.debian.org/CVE-2017-0377",
              "refsource": "CONFIRM",
              "url": "https://security-tracker.debian.org/CVE-2017-0377"
            },
            {
              "name": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients",
              "refsource": "CONFIRM",
              "url": "https://blog.torproject.org/blog/tor-0309-released-security-update-clients"
            },
            {
              "name": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients",
              "refsource": "CONFIRM",
              "url": "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"
            },
            {
              "name": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
              "refsource": "CONFIRM",
              "url": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5",
    "assignerShortName": "debian",
    "cveId": "CVE-2017-0377",
    "datePublished": "2017-07-02T15:00:00",
    "dateReserved": "2016-11-29T00:00:00",
    "dateUpdated": "2024-08-05T13:03:56.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted