High
Security advisory
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-0377
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:04 UTC · Revision 1
Source evidence
Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.
osv:CVE-2017-0377
Complete source record
{
"id": "f3cecc9d004122164166e23cd4134d580afd781ed557a02857cd1055166dfd6a",
"url": "https://osv.dev/vulnerability/CVE-2017-0377",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-0377",
"summary": "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.",
"evidence": "osv:CVE-2017-0377",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-0377",
"aliases": [
"CVE-2017-0377"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/torproject/tor",
"type": "GIT",
"events": [
{
"introduced": "ac04fcd2e758c2258cbde8c8f31586695cb5d666"
},
{
"last_affected": "802d30d9b71a6d54ef5fd1278ab4858b2e76e750"
},
{
"fixed": "665baf5ed5c6186d973c46cdea165c0548027350"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.1-alpha"
},
{
"last_affected": "0.3.0.1-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.2-alpha"
},
{
"last_affected": "0.3.0.2-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.3-alpha"
},
{
"last_affected": "0.3.0.3-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.6"
},
{
"last_affected": "0.3.0.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.7"
},
{
"last_affected": "0.3.0.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.8"
},
{
"last_affected": "0.3.0.8"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "665baf5ed5c6186d973c46cdea165c0548027350"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.3.0.1-alpha",
"0.3.0.2-alpha",
"0.3.0.3-alpha",
"0.3.0.6",
"0.3.0.7",
"0.3.0.8",
"tor-0.3.0.8",
"tor-0.3.0.7",
"tor-0.3.0.6",
"tor-0.3.0.5-rc",
"tor-0.3.0.4-rc",
"tor-0.3.0.3-alpha",
"tor-0.3.0.2-alpha",
"tor-0.3.0.1-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json",
"vanir_signatures": [
{
"id": "CVE-2017-0377-3ba73f86",
"digest": {
"threshold": 0.9,
"line_hashes": [
"44309939316981180280873473147461909284",
"245585645262755064580175351139636454420",
"276420338012471800371136648215023479706",
"242564737634043682203735875492122356622"
]
},
"source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"target": {
"file": "src/or/nodelist.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-0377-814b7942",
"digest": {
"threshold": 0.9,
"line_hashes": [
"130947375133832080065014793414556873519",
"120268657075388148935762763694518608359",
"2857889528935089052107406791916063482",
"260857398991327691730483878311310381440",
"172175267509838166657832256561720017092",
"33865109398391995941849264184178983308"
]
},
"source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"target": {
"file": "src/or/entrynodes.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2017-0377-a8e4b5b9",
"digest": {
"length": 193,
"function_hash": "4770935110876737590891931296231995318"
},
"source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"target": {
"file": "src/or/entrynodes.c",
"function": "entry_guard_obeys_restriction"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-0377-b33a84f1",
"digest": {
"length": 139,
"function_hash": "251812826122832502133715654618947189496"
},
"source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"target": {
"file": "src/or/nodelist.c",
"function": "addrs_in_same_network_family"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2017-0377-e6fb9c72",
"digest": {
"threshold": 0.9,
"line_hashes": [
"144861746393319512936649912835876713466",
"237643910232194103654179137966429429850",
"51470496634927409790148542464069951910",
"274032112497314191036839052981469061771"
]
},
"source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350",
"target": {
"file": "src/or/nodelist.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:05:34Z"
}
},
{
"ranges": [
{
"repo": "https://gitlab.torproject.org/tpo/core/tor",
"type": "GIT",
"events": [
{
"introduced": "ac04fcd2e758c2258cbde8c8f31586695cb5d666"
},
{
"last_affected": "802d30d9b71a6d54ef5fd1278ab4858b2e76e750"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.1-alpha"
},
{
"last_affected": "0.3.0.1-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.2-alpha"
},
{
"last_affected": "0.3.0.2-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.3-alpha"
},
{
"last_affected": "0.3.0.3-alpha"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.6"
},
{
"last_affected": "0.3.0.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.7"
},
{
"last_affected": "0.3.0.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.3.0.8"
},
{
"last_affected": "0.3.0.8"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"0.3.0.1-alpha",
"0.3.0.2-alpha",
"0.3.0.3-alpha",
"0.3.0.6",
"0.3.0.7",
"0.3.0.8",
"tor-0.3.0.8",
"tor-0.3.0.7",
"tor-0.3.0.6",
"tor-0.3.0.5-rc",
"tor-0.3.0.4-rc",
"tor-0.3.0.3-alpha",
"tor-0.3.0.2-alpha",
"tor-0.3.0.1-alpha"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json"
}
}
],
"modified": "2026-10-24T14:05:34.268773465Z",
"provider": "osv",
"references": [
"https://blog.torproject.org/blog/tor-0309-released-security-update-clients",
"https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients",
"https://security-tracker.debian.org/CVE-2017-0377",
"https://trac.torproject.org/projects/tor/ticket/22753",
"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:torproject:tor:0.3.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:torproject:tor:0.3.0.5:*:*:*:*:*:*:*"
],
"vendor_product": "torproject:tor",
"extracted_events": [
{
"range": [
{
"introduced": "0.3.0.4"
},
{
"last_affected": "0.3.0.4"
},
{
"introduced": "0.3.0.4"
},
{
"last_affected": "0.3.0.4"
},
{
"introduced": "0.3.0.5"
},
{
"last_affected": "0.3.0.5"
},
{
"introduced": "0.3.0.5"
},
{
"last_affected": "0.3.0.5"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-0377",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442970,
"published_at": "2017-07-02T15:29:00.187+00:00"
}