It's covered in this blog post[1]. Some mitigations are in place now.

[1]: https://blog.torproject.org/blog/tor-security-advisory-relay...