UnratedFix available
tor — security advisory
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.
- Products
- tor
- Affected versions
- Not specified
- Fixed versions
- 0.2.2.34-1
- CVEs
- CVE-2011-2768
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 23:34 UTC · Revision 1
Source evidence
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.
osv:DEBIAN-CVE-2011-2768
tor
Fixed versions: 0.2.2.34-1
tor
Fixed versions: 0.2.2.34-1
tor
Fixed versions: 0.2.2.34-1
Complete source record
{
"id": "7e83ad3ddfc953f8b523eefae5ee20c0e816c4a4e39d1d2035782290380a72ff",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2011-2768",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2011-2768",
"summary": "Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.",
"evidence": "osv:DEBIAN-CVE-2011-2768",
"products": [
{
"name": {
"value": "tor",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.2.34-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tor",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.2.34-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "tor",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.2.2.34-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2011-2768",
"aliases": [
"DEBIAN-CVE-2011-2768"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.2.34-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2768.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.2.34-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2768.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.2.34-1"
}
]
}
],
"package": {
"name": "tor",
"purl": "pkg:deb/debian/tor?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2011-2768.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T17:47:46.967709470Z",
"provider": "osv",
"upstream": [
"CVE-2011-2768"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2011-2768"
]
},
"related_cves": [
{
"value": "CVE-2011-2768",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 418918,
"published_at": "2011-12-23T03:59:21.957+00:00"
}