In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.

Affected: crates.io: arti, crates.io: tor-circmgr

In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.

Affected: crates.io: tor-circmgr

## Description

When building anonymizing circuits to or from an onion service with 'lite' vanguards (the default) enabled, the circuit manager code would build the circuits with one hop too few.

## Impact

This makes users of this code more vulnerable to some kinds of traffic analysis when they run or visit onion services.

## Vulnerable configurations and use cases

Arti configured with "vangaurds lite" is vulnerable; this is the default.

Only users who make connections to Onion Services (Tor Hidden Services) are affected. Note, however, that when used as a browser proxy, malicious web pages can typically make such connections.

## Mitigation

Enable the "full vanguards" feature. This has some cost in terms of performance, reliability, and impact on the Tor Network.

(Arti configured with "full vanguards" has a similar bug, TROVE-2024-04, so this will not deliver the full incressed security of "full vanguards"; but the security level of affected versions of Arti configured with "full vanguards" still exceeds the intended security level of the "vanguards lite" configuration.)

Alternatively, preventing access to Tor Hidden Services will avoid the problem, with corresponding loss of functionality. This can be achieved in the Arti configuration file with:

``` [address_filter] allow_onion_addrs = false ```

## Resolution

Rebuild `arti` (or other affected applications) with a fixed version of `tor-circmgr`: 0.18.1 or later.

The fixed `tor-circmgr` is on crates.io and ava…