CVE-2011-2768

2011-12-2303:59:21

Debian Security Bug Tracker

security-tracker.debian.org

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

43.0%

JSON

Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.

OSVersionArchitecturePackageVersionFilename
Debian12alltor< 0.2.2.34-1tor_0.2.2.34-1_all.deb
Debian11alltor< 0.2.2.34-1tor_0.2.2.34-1_all.deb
Debian999alltor< 0.2.2.34-1tor_0.2.2.34-1_all.deb
Debian13alltor< 0.2.2.34-1tor_0.2.2.34-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	tor	< 0.2.2.34-1	tor_0.2.2.34-1_all.deb
Debian	11	all	tor	< 0.2.2.34-1	tor_0.2.2.34-1_all.deb
Debian	999	all	tor	< 0.2.2.34-1	tor_0.2.2.34-1_all.deb
Debian	13	all	tor	< 0.2.2.34-1	tor_0.2.2.34-1_all.deb