Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
T
Tor
Manage
Activity
Members
Labels
Plan
Issues
Issue boards
Milestones
Wiki
Code
Merge requests
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Build
Pipelines
Jobs
Pipeline schedules
Artifacts
Deploy
Releases
Package Registry
Container Registry
Model registry
Operate
Environments
Terraform modules
Monitor
Incidents
Service Desk
Analyze
Value stream analytics
Contributor analytics
CI/CD analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Roger Dingledine
Tor
Commits
802d30d9
Commit
802d30d9
authored
7 years ago
by
Nick Mathewson
Browse files
Options
Downloads
Patches
Plain Diff
copy changelog to releasenotes
parent
2664156a
No related branches found
Branches containing commit
Tags
tor-0.4.3.3-alpha
Tags containing commit
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
ReleaseNotes
+77
-0
77 additions, 0 deletions
ReleaseNotes
with
77 additions
and
0 deletions
ReleaseNotes
+
77
−
0
View file @
802d30d9
...
...
@@ -2,6 +2,83 @@ This document summarizes new features and bugfixes in each stable release
of Tor. If you want to see more detailed descriptions of the changes in
each development snapshot, see the ChangeLog file.
Changes in version 0.3.0.8 - 2017-06-08
Tor 0.3.0.8 fixes a pair of bugs that would allow an attacker to
remotely crash a hidden service with an assertion failure. Anyone
running a hidden service should upgrade to this version, or to some
other version with fixes for TROVE-2017-004 and TROVE-2017-005.
Tor 0.3.0.8 also includes fixes for several key management bugs
that sometimes made relays unreliable, as well as several other
bugfixes described below.
o Major bugfixes (hidden service, relay, security, backport
from 0.3.1.3-alpha):
- Fix a remotely triggerable assertion failure when a hidden service
handles a malformed BEGIN cell. Fixes bug 22493, tracked as
TROVE-2017-004 and as CVE-2017-0375; bugfix on 0.3.0.1-alpha.
- Fix a remotely triggerable assertion failure caused by receiving a
BEGIN_DIR cell on a hidden service rendezvous circuit. Fixes bug
22494, tracked as TROVE-2017-005 and CVE-2017-0376; bugfix
on 0.2.2.1-alpha.
o Major bugfixes (relay, link handshake, backport from 0.3.1.3-alpha):
- When performing the v3 link handshake on a TLS connection, report
that we have the x509 certificate that we actually used on that
connection, even if we have changed certificates since that
connection was first opened. Previously, we would claim to have
used our most recent x509 link certificate, which would sometimes
make the link handshake fail. Fixes one case of bug 22460; bugfix
on 0.2.3.6-alpha.
o Major bugfixes (relays, key management, backport from 0.3.1.3-alpha):
- Regenerate link and authentication certificates whenever the key
that signs them changes; also, regenerate link certificates
whenever the signed key changes. Previously, these processes were
only weakly coupled, and we relays could (for minutes to hours)
wind up with an inconsistent set of keys and certificates, which
other relays would not accept. Fixes two cases of bug 22460;
bugfix on 0.3.0.1-alpha.
- When sending an Ed25519 signing->link certificate in a CERTS cell,
send the certificate that matches the x509 certificate that we
used on the TLS connection. Previously, there was a race condition
if the TLS context rotated after we began the TLS handshake but
before we sent the CERTS cell. Fixes a case of bug 22460; bugfix
on 0.3.0.1-alpha.
o Major bugfixes (hidden service v3, backport from 0.3.1.1-alpha):
- Stop rejecting v3 hidden service descriptors because their size
did not match an old padding rule. Fixes bug 22447; bugfix on
tor-0.3.0.1-alpha.
o Minor features (fallback directory list, backport from 0.3.1.3-alpha):
- Replace the 177 fallbacks originally introduced in Tor 0.2.9.8 in
December 2016 (of which ~126 were still functional) with a list of
151 fallbacks (32 new, 119 unchanged, 58 removed) generated in May
2017. Resolves ticket 21564.
o Minor bugfixes (configuration, backport from 0.3.1.1-alpha):
- Do not crash when starting with LearnCircuitBuildTimeout 0. Fixes
bug 22252; bugfix on 0.2.9.3-alpha.
o Minor bugfixes (correctness, backport from 0.3.1.3-alpha):
- Avoid undefined behavior when parsing IPv6 entries from the geoip6
file. Fixes bug 22490; bugfix on 0.2.4.6-alpha.
o Minor bugfixes (link handshake, backport from 0.3.1.3-alpha):
- Lower the lifetime of the RSA->Ed25519 cross-certificate to six
months, and regenerate it when it is within one month of expiring.
Previously, we had generated this certificate at startup with a
ten-year lifetime, but that could lead to weird behavior when Tor
was started with a grossly inaccurate clock. Mitigates bug 22466;
mitigation on 0.3.0.1-alpha.
o Minor bugfixes (memory leak, directory authority, backport from
0.3.1.2-alpha):
- When directory authorities reject a router descriptor due to
keypinning, free the router descriptor rather than leaking the
memory. Fixes bug 22370; bugfix on 0.2.7.2-alpha.
Changes in version 0.3.0.7 - 2017-05-15
Tor 0.3.0.7 fixes a medium-severity security bug in earlier versions
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment