CVE-2017-0377

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-0377
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-0377
Downstream
Related
Published
2017-07-02T15:29:00.187Z
Modified
2026-07-08T15:09:53.183166Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:torproject:tor:0.3.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:torproject:tor:0.3.0.5:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "0.3.0.4"
                },
                {
                    "last_affected": "0.3.0.4"
                },
                {
                    "introduced": "0.3.0.4"
                },
                {
                    "last_affected": "0.3.0.4"
                },
                {
                    "introduced": "0.3.0.5"
                },
                {
                    "last_affected": "0.3.0.5"
                },
                {
                    "introduced": "0.3.0.5"
                },
                {
                    "last_affected": "0.3.0.5"
                }
            ],
            "vendor_product": "torproject:tor",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/torproject/tor

Affected ranges

Type
GIT
Repo
https://github.com/torproject/tor
Events
Introduced
ac04fcd2e758c2258cbde8c8f31586695cb5d666
Last affected
802d30d9b71a6d54ef5fd1278ab4858b2e76e750
Fixed
665baf5ed5c6186d973c46cdea165c0548027350
Database specific 
{
    "cpe": [
        "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0.3.0.1-alpha"
        },
        {
            "last_affected": "0.3.0.1-alpha"
        },
        {
            "introduced": "0.3.0.2-alpha"
        },
        {
            "last_affected": "0.3.0.2-alpha"
        },
        {
            "introduced": "0.3.0.3-alpha"
        },
        {
            "last_affected": "0.3.0.3-alpha"
        },
        {
            "introduced": "0.3.0.6"
        },
        {
            "last_affected": "0.3.0.6"
        },
        {
            "introduced": "0.3.0.7"
        },
        {
            "last_affected": "0.3.0.7"
        },
        {
            "introduced": "0.3.0.8"
        },
        {
            "last_affected": "0.3.0.8"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.3.0.1-alpha
0.3.0.2-alpha
0.3.0.3-alpha
0.3.0.6
0.3.0.7
0.3.0.8
tor-0.*
tor-0.3.0.1-alpha
tor-0.3.0.2-alpha
tor-0.3.0.3-alpha
tor-0.3.0.4-rc
tor-0.3.0.5-rc
tor-0.3.0.6
tor-0.3.0.7
tor-0.3.0.8

Database specific

vanir_signatures_modified 
"2026-07-08T15:09:53Z"
vanir_signatures 
[
    {
        "target": {
            "file": "src/or/nodelist.c"
        },
        "id": "CVE-2017-0377-3ba73f86",
        "digest": {
            "line_hashes": [
                "44309939316981180280873473147461909284",
                "245585645262755064580175351139636454420",
                "276420338012471800371136648215023479706",
                "242564737634043682203735875492122356622"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    },
    {
        "target": {
            "file": "src/or/entrynodes.c"
        },
        "id": "CVE-2017-0377-814b7942",
        "digest": {
            "line_hashes": [
                "130947375133832080065014793414556873519",
                "120268657075388148935762763694518608359",
                "2857889528935089052107406791916063482",
                "260857398991327691730483878311310381440",
                "172175267509838166657832256561720017092",
                "33865109398391995941849264184178983308"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    },
    {
        "target": {
            "function": "entry_guard_obeys_restriction",
            "file": "src/or/entrynodes.c"
        },
        "id": "CVE-2017-0377-a8e4b5b9",
        "digest": {
            "function_hash": "4770935110876737590891931296231995318",
            "length": 193.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    },
    {
        "target": {
            "function": "addrs_in_same_network_family",
            "file": "src/or/nodelist.c"
        },
        "id": "CVE-2017-0377-b33a84f1",
        "digest": {
            "function_hash": "251812826122832502133715654618947189496",
            "length": 139.0
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    },
    {
        "target": {
            "file": "src/or/nodelist.h"
        },
        "id": "CVE-2017-0377-e6fb9c72",
        "digest": {
            "line_hashes": [
                "144861746393319512936649912835876713466",
                "237643910232194103654179137966429429850",
                "51470496634927409790148542464069951910",
                "274032112497314191036839052981469061771"
            ],
            "threshold": 0.9
        },
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json"

Git / gitlab.torproject.org/tpo/core/tor

Affected ranges

Type
GIT
Repo
https://gitlab.torproject.org/tpo/core/tor
Events
Introduced
ac04fcd2e758c2258cbde8c8f31586695cb5d666
Last affected
802d30d9b71a6d54ef5fd1278ab4858b2e76e750
Database specific 
{
    "cpe": [
        "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0.3.0.1-alpha"
        },
        {
            "last_affected": "0.3.0.1-alpha"
        },
        {
            "introduced": "0.3.0.2-alpha"
        },
        {
            "last_affected": "0.3.0.2-alpha"
        },
        {
            "introduced": "0.3.0.3-alpha"
        },
        {
            "last_affected": "0.3.0.3-alpha"
        },
        {
            "introduced": "0.3.0.6"
        },
        {
            "last_affected": "0.3.0.6"
        },
        {
            "introduced": "0.3.0.7"
        },
        {
            "last_affected": "0.3.0.7"
        },
        {
            "introduced": "0.3.0.8"
        },
        {
            "last_affected": "0.3.0.8"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*
0.3.0.1-alpha
0.3.0.2-alpha
0.3.0.3-alpha
0.3.0.6
0.3.0.7
0.3.0.8
tor-0.*
tor-0.3.0.1-alpha
tor-0.3.0.2-alpha
tor-0.3.0.3-alpha
tor-0.3.0.4-rc
tor-0.3.0.5-rc
tor-0.3.0.6
tor-0.3.0.7
tor-0.3.0.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json"