CVE-2011-2769
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in...
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
Exploit likelihood
What each source reports
NVD Score used
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
CVE-2011-2769- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
CVE-2011-2769- Updated
- 2026-11-02
EUVDEUVD-2011-2743 No score
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
EUVD-2011-2743- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8686-9px5-f96f No score
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in...
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
GHSA-8686-9px5-f96f- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV No score
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
CVE-2011-2769- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2769 No score
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
- Record
DEBIAN-CVE-2011-2769- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10423-1 No score
tor-0.2.8.11-1.1 on GA media
These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10423-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
torDebian:12 |
before 0.2.2.34-1 | 0.2.2.34-1 |
torDebian:13 |
before 0.2.2.34-1 | 0.2.2.34-1 |
torDebian:14 |
before 0.2.2.34-1 | 0.2.2.34-1 |
torDebian:6.0 |
before 0.2.1.31-1, plus listed versions 0.2.1.29-10.2.1.30-10.2.1.31-1~lenny+1 |
0.2.1.31-1 |
torDebian:5.0 |
before 0.2.1.31-1~lenny+1, plus listed versions 0.2.0.33-10.2.0.34-10.2.0.34-1~bpo40+10.2.0.35-10.2.0.35-1~lenny1 Show 45 moreShow less0.2.0.35-1~lenny20.2.1.10-alpha-10.2.1.11-alpha-10.2.1.12-alpha-10.2.1.13-alpha-10.2.1.14-rc-10.2.1.15-rc-10.2.1.16-rc-10.2.1.17-rc-10.2.1.18-10.2.1.19-10.2.1.2-alpha-10.2.1.20-10.2.1.20-20.2.1.21-10.2.1.21-1~bpo50+10.2.1.22-10.2.1.22-1~bpo50+10.2.1.23-10.2.1.23-20.2.1.25-10.2.1.25-1~bpo50+10.2.1.25-20.2.1.25-30.2.1.26-10.2.1.26-1~bpo50+10.2.1.26-1~lenny+10.2.1.26-1~lenny+20.2.1.26-1~lenny+40.2.1.26-1~lennyvolatile10.2.1.26-1~lennyvolatile20.2.1.26-20.2.1.26-30.2.1.26-40.2.1.26-4~bpo50+10.2.1.26-50.2.1.26-60.2.1.26-6~bpo50+10.2.1.29-10.2.1.29-1~lenny+10.2.1.30-10.2.1.4-alpha-10.2.1.5-alpha-10.2.1.6-alpha-10.2.1.7-alpha-1 |
0.2.1.31-1~lenny+1 |
toropenSUSE:Tumbleweed |
before 0.2.8.11-1.1 | 0.2.8.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2769 is a medium vulnerability (CVSS 4.3) in Tor, published October 28, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in tor 0.2.2.34-1.
References
blog.torproject.org/blog/tor-02234-released-security-patches
debian.org/security/2011/dsa-2331
nvd.nist.gov/vuln/detail/CVE-2011-2769
github.com/advisories/GHSA-8686-9px5-f96f
security-tracker.debian.org/tracker/CVE-2011-2769
suse.com/security/cve/CVE-2011-0427
Show 21 moreShow less
Left out here: 3 versions. The JSON record has them.