Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
RUSTSEC-2024-0340
No affected components available
Description
When building anonymizing circuits to or from an onion service with full vanguards enabled, the circuit manager code would build the circuits with one hop too few.
Impact
This makes users of this code more vulnerable to some kinds of traffic analysis when they run or visit onion services.
Vulnerable configurations and use cases
Arti configured with "full vangaurds" is vulnerable.
Only users who make connections to Onion Services (Tor Hidden Services) are affected. Note, however, that when used as a browser proxy, malicious web pages can typically make such connections.
Mitigation
Preventing access to Tor Hidden Services will avoid the problem, with corresponding loss of functionality. This can be achieved in the Arti configuration file with:
[address_filter]
allow_onion_addrs = false
Changing the configuration (eg to turn off vanguards) reclassifies the behaviour as "as configured", but reduces security rather than improving it, so is not a mitigation.
Resolution
Rebuild arti (or other affected applications)
with a fixed version of tor-circmgr:
0.18.1 or later.
The fixed tor-circmgr is on crates.io and available in
the upstream git repository
at signed tag arti-v1.2.3.
Note about older versions
Even though earlier versions are classified as "not affected", this is because in those versions the Vanguards feature is experimental, or absent. Downgrading worsens security, rather than improving it.
References
Measures severity based on intrinsic characteristics of the vulnerability, independent of environment.
No exploitation activity has been observed at this time. Continue routine monitoring.
Probability that this vulnerability will be exploited in the wild within the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard