Description
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | tor | 0.2.2.34-1 | — |
| Debian 13 | tor | 0.2.2.34-1 | — |
| Debian 12 | tor | 0.2.2.34-1 | — |
| Debian 6.0 | tor | 0.2.1.31-1 | DSA-2331-1 |
| Debian 5.0 | tor | 0.2.1.31-1~lenny+1 | DSA-2331-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | tor | 0.2.8.11-1.1 | openSUSE-SU-2024:10423-1 |
Advisories 2
- DSA-2331-1 tor - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10423-1 tor-0.2.8.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026