GHSA-h978-fv3x-h43g

GHSA-h978-fv3x-h43g PUBLISHED

Record from GitHub Advisory Database · Published May 17, 2022

Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.

Timeline

May 17, 2022 CVE Published
Apr 29, 2026 Distribution Patch
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-h978-fv3x-h43g
vulnetix vdb fixes GHSA-h978-fv3x-h43g

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-h978-fv3x-h43g/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://blog.torproject.org/blog/tor-02234-released-security-patches url
https://nvd.nist.gov/vuln/detail/CVE-2011-2768 advisory
http://www.debian.org/security/2011/dsa-2331 url

Look up in the Resolve Platform →