Description
Tor before 0.1.2.14 can construct circuits in which an entry guard is in the same family as the exit node, which might compromise the anonymity of traffic sources and destinations by exposing traffic to inappropriate remote observers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tor | 0.1.2.14-1 | — |
| Debian 13 | tor | 0.1.2.14-1 | — |
| Debian 12 | tor | 0.1.2.14-1 | — |
References
- 25415 third-party-advisory
- ADV-2007-1964 vdb-entry
- 35670 vdb-entry
- 24180 vdb-entry
- [or-announce] 20070525 Tor 0.1.2.14 is released mailing-list