Tor Browser 11.5.2 is now available from the Tor Browser download page and also from our
distribution directory.
Tor Browser 11.5.2 updates Firefox on Windows, macOS, and Linux to 91.13.0esr.
This version includes important security updates to Firefox:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-35/
We use the opportunity as well to update various other components of Tor Browser:
Tor 0.4.7.10
NoScript 11.4.9
The full changelog since Tor Browser 11.5.1 is:
All Platforms
Update Tor to 0.4.7.10
Update NoScript to 11.4.9
Windows + macOS + Linux
Update Firefox to 91.13.0esr
Bug tor-browser#27719: Treat unsafe renegotiation as broken
Bug tor-browser#40242: Tor Browser has two default bridges that share a fingerprint, and
Tor ignores one
Bug tor-browser#41067: Cherry-pick fixes for HTTPS-Only mode
Bug tor-browser#41070: Google vanished from default search options from 11.0.10 onwards
Bug tor-browser#41075: The Tor Browser is showing caution sign but your document said it won't
Bug tor-browser#41089: Add tor-browser build scripts + Makefile to tor-browser
Bug tor-browser#41095: "Learn more" link in onboarding slideshow still points to 11.0
release post
Build System
Windows + macOS + Linux
Update Go to 1.17.3
Android
Update Go to 1.18.5
Greetings,
We had to do an emergency release due to an IPFire GeoIP database bug they
informed us about.
Announcement:
https://forum.torproject.net/t/urgent-stable-release-0-4-5-14-0-4-6-12-and-…
Dear packagers, sorry about the inconvenience but we had no choice. ChangeLog
below.
Cheers!
David
Changes in version 0.4.7.10 - 2022-08-12
This version updates the geoip cache that we generate from IPFire location
database to use the August 9th, 2022 one. Everyone MUST update to this
latest release else circuit path selection and relay metrics are badly
affected.
o Major bugfixes (geoip data):
- IPFire informed us on August 12th that databases generated after
(including) August 10th did not have proper ARIN network allocations. We
are updating the database to use the one generated on August 9th, 2022.
Fixes bug 40658; bugfix on 0.4.7.9.
--
3CBm2Bbvakv+fCJGDKJrAZGUoUfOOQOqR7XrrPOT9n8=
Greetings,
We just released 3 new stable versions which, in part, will help with the
ongoing DoS attack on the network.
Announcement: https://forum.torproject.net/t/stable-release-0-4-5-13-0-4-6-11-and-0-4-7-9…
We strongly urge everyone to upgrade to the latest stable! Also, this is the
very last release of the 0.4.6.x series as it is end of life since August 1st
2022.
Below is the ChangeLog for all 3 versions
Cheers!
David
--
Changes in version 0.4.7.9 - 2022-08-11
This version contains several major fixes aimed at reducing memory pressure on
relays and possible side-channel. It also contains a major bugfix related to
congestion control also aimed at reducing memory pressure on relays.
Finally, there is last one major bugfix related to Vanguard L2 layer node
selection.
We strongly recommend to upgrade to this version especially for Exit relays
in order to help the network defend against this ongoing DDoS.
o Major bugfixes (congestion control):
- Implement RFC3742 Limited Slow Start. Congestion control was
overshooting the congestion window during slow start, particularly
for onion service activity. With this fix, we now update the
congestion window more often during slow start, as well as dampen
the exponential growth when the congestion window grows above a
capping parameter. This should reduce the memory increases guard
relays were seeing, as well as allow us to set lower queue limits
to defend against ongoing DoS attacks. Fixes bug 40642; bugfix
on 0.4.7.5-alpha.
o Major bugfixes (relay):
- Remove OR connections btrack subsystem entries when the connections
close normally. Before this, we would only remove the entry on error and
thus leaking memory for each normal OR connections. Fixes bug 40604;
bugfix on 0.4.0.1-alpha.
- Stop sending TRUNCATED cell and instead close the circuit from which we
received a DESTROY cell. This makes every relay in the circuit path to
stop queuing cells. Fixes bug 40623; bugfix on 0.1.0.2-rc.
o Major bugfixes (vanguards):
- We had omitted some checks for whether our vanguards (second layer
guards from proposal 333) overlapped. Now make sure to pick each
of them to be independent. Also, change the design to allow them
to come from the same family. Fixes bug 40639; bugfix
on 0.4.7.1-alpha.
o Minor features (dirauth):
- Add a torrc option to control the Guard flag bandwidth threshold
percentile. Closes ticket 40652.
- Add an AuthDirVoteGuard torrc option that can allow authorities to
assign the Guard flag to the given fingerprints/country code/IPs.
This is a needed feature mostly for defense purposes in case a DoS
hits the network and relay start losing the Guard flags too fast.
- Make UPTIME_TO_GUARANTEE_STABLE, MTBF_TO_GUARANTEE_STABLE,
TIME_KNOWN_TO_GUARANTEE_FAMILIAR WFU_TO_GUARANTEE_GUARD tunable
from torrc.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on August 11, 2022.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2022/08/11.
o Minor bugfixes (congestion control):
- Add a check for an integer underflow condition that might happen
in cases where the system clock is stopped, the ORconn is blocked,
and the endpoint sends more than a congestion window worth of non-
data control cells at once. This would cause a large congestion
window to be calculated instead of a small one. No security
impact. Fixes bug 40644; bugfix on 0.4.7.5-alpha.
o Minor bugfixes (defense in depth):
- Change a test in the netflow padding code to make it more
_obviously_ safe against remotely triggered crashes. (It was safe
against these before, but not obviously so.) Fixes bug 40645;
bugfix on 0.3.1.1-alpha.
o Minor bugfixes (relay):
- Do not propagate either forward or backward a DESTROY remote reason when
closing a circuit in order to avoid a possible side channel. Fixes bug
40649; bugfix on 0.1.2.4-alpha.
Changes in version 0.4.6.11 - 2022-08-11
This version contains two major fixes aimed at reducing memory pressure on
relays and possible side-channel. The rest of the fixes were backported for
stability or safety purposes.
This is the very LAST version of this series. As of August 1st 2022, it is
end-of-life (EOL). We thus strongly recommend to upgrade to the latest
stable of the 0.4.7.x series.
o Major bugfixes (relay):
- Remove OR connections btrack subsystem entries when the connections
close normally. Before this, we would only remove the entry on error and
thus leaking memory for each normal OR connections. Fixes bug 40604;
bugfix on 0.4.0.1-alpha.
- Stop sending TRUNCATED cell and instead close the circuit from which we
received a DESTROY cell. This makes every relay in the circuit path to
stop queuing cells. Fixes bug 40623; bugfix on 0.1.0.2-rc.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on August 11, 2022.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2022/08/11.
o Minor features (linux seccomp2 sandbox):
- Permit the clone3 syscall, which is apparently used in glibc-2.34
and later. Closes ticket 40590.
o Minor bugfixes (controller, path bias):
- When a circuit's path is specified, in full or in part, from the
controller API, do not count that circuit towards our path-bias
calculations. (Doing so was incorrect, since we cannot tell
whether the controller is selecting relays randomly.) Resolves a
"Bug" warning. Fixes bug 40515; bugfix on 0.2.4.10-alpha.
o Minor bugfixes (defense in depth):
- Change a test in the netflow padding code to make it more
_obviously_ safe against remotely triggered crashes. (It was safe
against these before, but not obviously so.) Fixes bug 40645;
bugfix on 0.3.1.1-alpha.
o Minor bugfixes (linux seccomp2 sandbox):
- Allow the rseq system call in the sandbox. This solves a crash
issue with glibc 2.35 on Linux. Patch from pmu-ipf. Fixes bug
40601; bugfix on 0.3.5.11.
o Minor bugfixes (metrics port, onion service):
- The MetricsPort line for an onion service with multiple ports are now
unique that is one line per port. Before this, all ports of an onion
service would be on the same line which violates the Prometheus rules of
unique labels. Fixes bug 40581; bugfix on 0.4.5.1-alpha.
o Minor bugfixes (onion service, client):
- Fix a fatal assert due to a guard subsystem recursion triggered by
the onion service client. Fixes bug 40579; bugfix on 0.3.5.1-alpha.
o Minor bugfixes (performance, DoS):
- Fix one case of a not-especially viable denial-of-service attack
found by OSS-Fuzz in our consensus-diff parsing code. This attack
causes a lot small of memory allocations and then immediately
frees them: this is only slow when running with all the sanitizers
enabled. Fixes one case of bug 40472; bugfix on 0.3.1.1-alpha.
o Minor bugfixes (relay):
- Do not propagate either forward or backward a DESTROY remote reason when
closing a circuit in order to avoid a possible side channel. Fixes bug
40649; bugfix on 0.1.2.4-alpha.
Changes in version 0.4.5.13 - 2022-08-11
This version contains two major fixes aimed at reducing memory pressure on
relays and possible side-channel. The rest of the fixes were backported for
stability or safety purposes. We strongly recommend to upgrade your relay to
this version or, ideally, to the latest stable of the 0.4.7.x series.
o Major bugfixes (relay):
- Remove OR connections btrack subsystem entries when the connections
close normally. Before this, we would only remove the entry on error and
thus leaking memory for each normal OR connections. Fixes bug 40604;
bugfix on 0.4.0.1-alpha.
- Stop sending TRUNCATED cell and instead close the circuit from which we
received a DESTROY cell. This makes every relay in the circuit path to
stop queuing cells. Fixes bug 40623; bugfix on 0.1.0.2-rc.
o Minor features (fallbackdir):
- Regenerate fallback directories generated on August 11, 2022.
o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2022/08/11.
o Minor features (linux seccomp2 sandbox):
- Permit the clone3 syscall, which is apparently used in glibc-2.34
and later. Closes ticket 40590.
o Minor bugfixes (controller, path bias):
- When a circuit's path is specified, in full or in part, from the
controller API, do not count that circuit towards our path-bias
calculations. (Doing so was incorrect, since we cannot tell
whether the controller is selecting relays randomly.) Resolves a
"Bug" warning. Fixes bug 40515; bugfix on 0.2.4.10-alpha.
o Minor bugfixes (defense in depth):
- Change a test in the netflow padding code to make it more
_obviously_ safe against remotely triggered crashes. (It was safe
against these before, but not obviously so.) Fixes bug 40645;
bugfix on 0.3.1.1-alpha.
o Minor bugfixes (linux seccomp2 sandbox):
- Allow the rseq system call in the sandbox. This solves a crash
issue with glibc 2.35 on Linux. Patch from pmu-ipf. Fixes bug
40601; bugfix on 0.3.5.11.
o Minor bugfixes (metrics port, onion service):
- The MetricsPort line for an onion service with multiple ports are now
unique that is one line per port. Before this, all ports of an onion
service would be on the same line which violates the Prometheus rules of
unique labels. Fixes bug 40581; bugfix on 0.4.5.1-alpha.
o Minor bugfixes (onion service, client):
- Fix a fatal assert due to a guard subsystem recursion triggered by
the onion service client. Fixes bug 40579; bugfix on 0.3.5.1-alpha.
o Minor bugfixes (performance, DoS):
- Fix one case of a not-especially viable denial-of-service attack
found by OSS-Fuzz in our consensus-diff parsing code. This attack
causes a lot small of memory allocations and then immediately
frees them: this is only slow when running with all the sanitizers
enabled. Fixes one case of bug 40472; bugfix on 0.3.1.1-alpha.
o Minor bugfixes (relay):
- Do not propagate either forward or backward a DESTROY remote reason when
closing a circuit in order to avoid a possible side channel. Fixes bug
40649; bugfix on 0.1.2.4-alpha.
--
m2jOdc71eksaeTawBhtVwkp+r1hg+dcgIW1GrSON+pY=
