November 2022 - tor-announce - lists.torproject.org

New Release: Tor Browser 11.5.10 (Android)
by Richard Pospesel 29 Nov '22

29 Nov '22

Tor Browser 11.5.10 is now available from the Tor Browser download page and also from our distribution directory: - https://www.torproject.org/dist/torbrowser/11.5.10/ This is an Android-only release which fixes crashes on Android 12+ devices caused by the targetSdkVersion update in 11.5.9. The full changelog since Tor Browser 11.5.9 is: Android Update NoScript to 11.4.13 Bug tor-browser#41481: Tor Browser 11.5.9 for Android crashes on launch on Android 12+ after targetSdkVersion update

1 0

New Release: Tor Browser 11.5.8 (Android, Windows, macOS, Linux)
by Richard Pospesel 22 Nov '22

22 Nov '22

Tor Browser 11.5.8 is now available from the Tor Browser download page and also from our distribution directory. - https://dist.torproject.org/torbrowser/11.5.8/ This release will not be published on Google Play due to their target API level requirements. Assuming we do not run into any major problems, Tor Browser 11.5.9 will be an Android-only release that fixes this issue. Tor Browser 11.5.8 backports the following security updates from Firefox ESR 102.5 to Firefox ESR 91.13 on Windows, macOS and Linux: CVE-2022-43680: In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. CVE-2022-45403: Service Workers might have learned size of cross-origin media files CVE-2022-45404: Fullscreen notification bypass CVE-2022-45405: Use-after-free in InputStream implementation CVE-2022-45406: Use-after-free of a JavaScript Realm CVE-2022-45408: Fullscreen notification bypass via windowName CVE-2022-45409: Use-after-free in Garbage Collection CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy CVE-2022-45411: Cross-Site Tracing was possible via non-standard override headers CVE-2022-45412: Symlinks may resolve to partially uninitialized buffers CVE-2022-45416: Keystroke Side-Channel Leakage CVE-2022-45420: Iframe contents could be rendered outside the iframe CVE-2022-45421: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5 Tor Browser 11.5.8 updates GeckoView on Android to Firefox ESR 102.5 and includes important security updates. Tor Browser 11.5.8 backports the following security updates from Firefox 107 to Firefox ESR 102.5 on Android: CVE-2022-45413: SameSite=Strict cookies could have been sent cross-site via intent URLs The full changelog since Tor Browser 11.5.7 is: All Platforms Update Translations Update OpenSSL to 1.1.1s Update NoScript to 11.4.12 Update tor to 0.4.7.11 Update zlib to 1.2.13 Bug tor-browser-build#40622: Update obfs4proxy to 0.0.14 in Tor Browser Windows + macOS + Linux Bug tor-browser#31064: Letterboxing is enabled in priviledged contexts too Bug tor-browser#32411: Consider adding about:tor and others to the list of pages that do not need letterboxing Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x Bug tor-browser#41434: Letterboxing bypass through secondary tab (popup/popunder...) Bug tor-browser#41456: Backport ESR 102.5 security fixes to 91.13-based Tor Browser Bug tor-browser#41460: Migrate new identity and security level preferences in 11.5.8 Bug tor-browser#41463: Backport fix for CVE-2022-43680 Android Update GeckoView to 102.5.0esr Bug tor-browser#41461: Backport Android-specific 107-rr security fixes to 102.5-esr based Geckoview Build All Platforms Update Go to 1.18.8 Bug tor-browser-build#40658: Create an anticensorship team keyring Bug tor-browser-build#40690: Revert fix for zlib build break

1 0

Tor stable release 0.4.7.11
by David Goulet 10 Nov '22

10 Nov '22

Greetings, We just released the latest stable tor 0.4.7.11. As usual, we strongly recommend you upgrade. Announcement: https://forum.torproject.net/t/stable-release-0-4-7-11/5501 ChangeLog: Changes in version 0.4.7.11 - 2022-11-10 This version contains several major fixes aimed at helping defend against network denial of service. It is also extending drastically the MetricsPort for relays to help us gather more internal data to investigate performance and attacks. We strongly recommend to upgrade to this version especially for Exit relays in order to help the network defend against this ongoing DDoS. o Directory authority changes (dizum, Faravahar): - Change dizum IP address. Closes ticket 40687. - Remove Faravahar until its operator, Sina, set it back up online outside of Team Cymru network. Closes ticket 40688. o Major bugfixes (geoip data): - IPFire informed us on August 12th that databases generated after (including) August 10th did not have proper ARIN network allocations. We are updating the database to use the one generated on August 9th, 2022. Fixes bug 40658; bugfix on 0.4.5.13. o Major bugfixes (onion service): - Set a much higher circuit build timeout for opened client rendezvous circuit. Before this, tor would time them out very quickly leading to unnecessary retries meaning more load on the network. Fixes bug 40694; bugfix on 0.3.5.1-alpha. o Major bugfixes (OSX): - Fix coarse-time computation on Apple platforms (like Mac M1) where the Mach absolute time ticks do not correspond directly to nanoseconds. Previously, we computed our shift value wrong, which led us to give incorrect timing results. Fixes bug 40684; bugfix on 0.3.3.1-alpha. o Major bugfixes (relay): - Improve security of our DNS cache by randomly clipping the TTL value. TROVE-2021-009. Fixes bug 40674; bugfix on 0.3.5.1-alpha. o Minor feature (Mac and iOS build): - Change how combine_libs works on Darwin like platforms to make sure we don't include any `__.SYMDEF` and `__.SYMDEF SORTED` symbols on the archive before we repack and run ${RANLIB} on the archive. This fixes a build issue with recent Xcode versions on Mac Silicon and iOS. Closes ticket 40683. o Minor feature (metrics): - Add various congestion control counters to the MetricsPort. Closes ticket 40708. o Minor feature (performance): - Bump the maximum amount of CPU that can be used from 16 to 128. Note that NumCPUs torrc option overrides this hardcoded maximum. Fixes bug 40703; bugfix on 0.3.5.1-alpha. o Minor feature (relay): - Make an hardcoded value for the maximum of per CPU tasks into a consensus parameter. - Two new consensus parameters are added to control the wait time in queue of the onionskins. One of them is the torrc MaxOnionQueueDelay options which supersedes the consensus parameter. Closes ticket 40704. o Minor feature (relay, DoS): - Apply circuit creation anti-DoS defenses if the outbound circuit max cell queue size is reached too many times. This introduces two new consensus parameters to control the queue size limit and number of times allowed to go over that limit. Closes ticket 40680. o Minor feature (relay, metrics): - Add DoS defenses counter to MetricsPort. - Add congestion control RTT reset counter to MetricsPort. - Add counters to the MetricsPort how many connections, per type, are currently opened and how many were created. - Add relay flags from the consensus to the MetricsPort. - Add total number of opened circuits to MetricsPort. - Add total number of streams seen by an Exit to the MetricsPort. - Add traffic stats as in number of read/written bytes in total. - Related to ticket 40194. o Minor features (fallbackdir): - Regenerate fallback directories generated on November 10, 2022. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2022/11/10. o Minor bugfixes (authorities, sandbox): - Allow to write file my-consensus-<flavor-name> to disk when sandbox is activated. Fixes bug 40663; bugfix on 0.3.5.1-alpha. o Minor bugfixes (dirauth): - Directory authorities stop voting a consensus "Measured" weight for relays with the Authority flag. Now these relays will be considered unmeasured, which should reserve their bandwidth for their dir auth role and minimize distractions from other roles. In place of the "Measured" weight, they now include a "MeasuredButAuthority" weight (not used by anything) so the bandwidth authority's opinion on this relay can be recorded for posterity. Lastly, remove the AuthDirDontVoteOnDirAuthBandwidth torrc option which never worked right. Fixes bugs 40698 and 40700; bugfix on 0.4.7.2-alpha. o Minor bugfixes (onion service client): - A collapsing onion service circuit should be seen as an "unreachable" error so it can be retried. Fixes bug 40692; bugfix on 0.3.5.1-alpha. o Minor bugfixes (onion service): - Make the service retry a rendezvous if the circuit is being repurposed for measurements. Fixes bug 40696; bugfix on 0.3.5.1-alpha. o Minor bugfixes (relay overload statistics): - Count total create cells vs dropped create cells properly, when assessing if our fraction of dropped cells is too high. We only count non-client circuits in the denominator, but we would include client circuits in the numerator, leading to surprising log lines claiming that we had dropped more than 100% of incoming create cells. Fixes bug 40673; bugfix on 0.4.7.1-alpha. o Code simplification and refactoring (bridges): - Remove unused code related to ExtPort connection ID. Fixes bug 40648; bugfix on 0.3.5.1-alpha. Cheers! David -- hZneJUk5igeV4rJ7+XERfxw3J5MVx71fwVx6lK72yUk=

1 0

New Release: Tor Browser 11.5.7 (Windows, macOS, Linux)
by Richard Pospesel 03 Nov '22

03 Nov '22

Tor Browser 11.5.7 is now available from the Tor Browser download page and also from our distribution directory. This is a minor release for desktop platforms intended to facilitate the single-locale to multi-locale bundle upgrade coming with the 12.0 series later this month. The full changelog since Tor Browser 11.5.6 is: Windows + macOS + Linux Bug tor-browser#41413: Backup intl.locale.requested in 11.5.x

1 0