Every CVE Search/ Get API key

CVE-2017-0376

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure...

7.5 HighFix available

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.18%Up 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
CVE-2017-0376
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-617
Updated
2026-11-02
CVE List No score

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
CVE-2017-0376
Updated
2026-11-02
EUVDEUVD-2017-0730 No score

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
EUVD-2017-0730
Updated
2026-11-03
GitHub AdvisoriesGHSA-4cxm-8xrj-7c53 7.5

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure...

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
GHSA-4cxm-8xrj-7c53
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-617
Updated
2026-11-02
OSV 7.5

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
CVE-2017-0376
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-0376 7.5

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
DEBIAN-CVE-2017-0376
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-0376 7.5

The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit.

Record
UBUNTU-CVE-2017-0376
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2017-0176 No score

Updated tor packages fix security vulnerability

A remotely triggerable assertion failure caused by receiving a BEGIN_DIR cell on a hidden service rendezvous circuit (CVE-2017-0376).

Record
MGASA-2017-0176
Updated
2026-11-02
OSVopenSUSE-SU-2024:11469-1 No score

tor-0.4.6.7-2.2 on GA media

These are all security issues fixed in the tor-0.4.6.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11469-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tor
Debian:12
 before 0.2.9.11-1
0.2.9.11-1
tor
Debian:13
 before 0.2.9.11-1
0.2.9.11-1
tor
Debian:14
 before 0.2.9.11-1
0.2.9.11-1
tor
Debian:7
 before 0.2.4.29-1, plus listed versions
0.2.3.25-10.2.4.1-alpha-10.2.4.10-alpha-10.2.4.11-alpha-10.2.4.12-alpha-1
Show 30 moreShow less
0.2.4.12-alpha-20.2.4.13-alpha-10.2.4.14-alpha-10.2.4.15-rc-10.2.4.16-rc-10.2.4.17-rc-10.2.4.18-rc-10.2.4.19-10.2.4.2-alpha-10.2.4.20-10.2.4.21-10.2.4.22-10.2.4.22-1~bpo70+10.2.4.22-1~deb7u10.2.4.23-10.2.4.23-1~deb6u10.2.4.23-1~deb7u10.2.4.24-10.2.4.26-10.2.4.26-1~deb6u10.2.4.27-10.2.4.27-1~deb6u10.2.4.27-20.2.4.27-30.2.4.3-alpha-10.2.4.4-alpha-10.2.4.5-alpha-10.2.4.6-alpha-10.2.4.7-alpha-10.2.4.9-alpha-1
0.2.4.29-1
tor
Debian:8
 before 0.2.5.14-1, plus listed versions
0.2.5.12-10.2.5.12-20.2.5.12-30.2.5.12-4
0.2.5.14-1
tor
Debian:9
 before 0.2.9.11-1~deb9u1, plus listed versions
0.2.9.10-10.2.9.11-1~bpo8+1
0.2.9.11-1~deb9u1
tor
Mageia:5
 before 0.2.8.14-1.mga5
0.2.8.14-1.mga5
tor
Ubuntu:14.04:LTS
 before 0.2.4.27-1ubuntu0.1, plus listed versions
0.2.3.25-10.2.4.19-10.2.4.20-10.2.4.27-1build0.14.04.1
0.2.4.27-1ubuntu0.1
tor
openSUSE:Tumbleweed
From an advisory covering 22 CVEs
 before 0.4.6.7-2.2
0.4.6.7-2.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-0376 is a high vulnerability (CVSS 7.5) in Torproject Tor, published June 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. Fixed in tor 0.2.9.11-1.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open