{"id":"CVE-2017-0377","details":"Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.","modified":"2026-07-08T15:09:53.183166Z","published":"2017-07-02T15:29:00.187Z","related":["openSUSE-SU-2024:11469-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:torproject:tor:0.3.0.4:*:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.3.0.4"},{"last_affected":"0.3.0.4"},{"introduced":"0.3.0.4"},{"last_affected":"0.3.0.4"},{"introduced":"0.3.0.5"},{"last_affected":"0.3.0.5"},{"introduced":"0.3.0.5"},{"last_affected":"0.3.0.5"}],"source":"CPE_STRING","vendor_product":"torproject:tor"}]},"references":[{"type":"ADVISORY","url":"https://blog.torproject.org/blog/tor-0309-released-security-update-clients"},{"type":"ADVISORY","url":"https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/CVE-2017-0377"},{"type":"REPORT","url":"https://trac.torproject.org/projects/tor/ticket/22753"},{"type":"FIX","url":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/torproject/tor","events":[{"introduced":"ac04fcd2e758c2258cbde8c8f31586695cb5d666"},{"last_affected":"802d30d9b71a6d54ef5fd1278ab4858b2e76e750"},{"fixed":"665baf5ed5c6186d973c46cdea165c0548027350"}],"database_specific":{"cpe":["cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.3.0.1-alpha"},{"last_affected":"0.3.0.1-alpha"},{"introduced":"0.3.0.2-alpha"},{"last_affected":"0.3.0.2-alpha"},{"introduced":"0.3.0.3-alpha"},{"last_affected":"0.3.0.3-alpha"},{"introduced":"0.3.0.6"},{"last_affected":"0.3.0.6"},{"introduced":"0.3.0.7"},{"last_affected":"0.3.0.7"},{"introduced":"0.3.0.8"},{"last_affected":"0.3.0.8"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.3.0.1-alpha","0.3.0.2-alpha","0.3.0.3-alpha","0.3.0.6","0.3.0.7","0.3.0.8","tor-0.3.0.8","tor-0.3.0.7","tor-0.3.0.6","tor-0.3.0.5-rc","tor-0.3.0.4-rc","tor-0.3.0.3-alpha","tor-0.3.0.2-alpha","tor-0.3.0.1-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json","vanir_signatures_modified":"2026-07-08T15:09:53Z","vanir_signatures":[{"id":"CVE-2017-0377-3ba73f86","signature_type":"Line","signature_version":"v1","source":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350","target":{"file":"src/or/nodelist.c"},"deprecated":false,"digest":{"line_hashes":["44309939316981180280873473147461909284","245585645262755064580175351139636454420","276420338012471800371136648215023479706","242564737634043682203735875492122356622"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["130947375133832080065014793414556873519","120268657075388148935762763694518608359","2857889528935089052107406791916063482","260857398991327691730483878311310381440","172175267509838166657832256561720017092","33865109398391995941849264184178983308"],"threshold":0.9},"id":"CVE-2017-0377-814b7942","signature_type":"Line","signature_version":"v1","source":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350","target":{"file":"src/or/entrynodes.c"}},{"signature_version":"v1","source":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350","target":{"file":"src/or/entrynodes.c","function":"entry_guard_obeys_restriction"},"deprecated":false,"digest":{"function_hash":"4770935110876737590891931296231995318","length":193},"id":"CVE-2017-0377-a8e4b5b9","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350","target":{"file":"src/or/nodelist.c","function":"addrs_in_same_network_family"},"deprecated":false,"digest":{"function_hash":"251812826122832502133715654618947189496","length":139},"id":"CVE-2017-0377-b33a84f1"},{"source":"https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350","target":{"file":"src/or/nodelist.h"},"deprecated":false,"digest":{"line_hashes":["144861746393319512936649912835876713466","237643910232194103654179137966429429850","51470496634927409790148542464069951910","274032112497314191036839052981469061771"],"threshold":0.9},"id":"CVE-2017-0377-e6fb9c72","signature_type":"Line","signature_version":"v1"}]}},{"ranges":[{"type":"GIT","repo":"https://gitlab.torproject.org/tpo/core/tor","events":[{"introduced":"ac04fcd2e758c2258cbde8c8f31586695cb5d666"},{"last_affected":"802d30d9b71a6d54ef5fd1278ab4858b2e76e750"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*","cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.3.0.1-alpha"},{"last_affected":"0.3.0.1-alpha"},{"introduced":"0.3.0.2-alpha"},{"last_affected":"0.3.0.2-alpha"},{"introduced":"0.3.0.3-alpha"},{"last_affected":"0.3.0.3-alpha"},{"introduced":"0.3.0.6"},{"last_affected":"0.3.0.6"},{"introduced":"0.3.0.7"},{"last_affected":"0.3.0.7"},{"introduced":"0.3.0.8"},{"last_affected":"0.3.0.8"}]}}],"versions":["0.3.0.1-alpha","0.3.0.2-alpha","0.3.0.3-alpha","0.3.0.6","0.3.0.7","0.3.0.8","tor-0.3.0.8","tor-0.3.0.7","tor-0.3.0.6","tor-0.3.0.5-rc","tor-0.3.0.4-rc","tor-0.3.0.3-alpha","tor-0.3.0.2-alpha","tor-0.3.0.1-alpha"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-0377.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}