October 2014 - tor-commits - lists.torproject.org

[tor/release-0.2.4] copy 0.2.4.25 entry from ChangeLog to ReleaseNotes.
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit 6b2ed1a905ce2ca50a480d319368b676de124d6d Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 22:09:04 2014 -0400 copy 0.2.4.25 entry from ChangeLog to ReleaseNotes. --- ReleaseNotes | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index cbd6421..1d42075 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -3,6 +3,23 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.2.4.25 - 2014-10-20 + Tor 0.2.4.25 disables SSL3 in response to the recent "POODLE" attack + (even though POODLE does not affect Tor). It also works around a crash + bug caused by some operating systems' response to the "POODLE" attack + (which does affect Tor). + + o Major security fixes (also in 0.2.5.9-rc): + - Disable support for SSLv3. All versions of OpenSSL in use with Tor + today support TLS 1.0 or later, so we can safely turn off support + for this old (and insecure) protocol. Fixes bug 13426. + + o Major bugfixes (openssl bug workaround, also in 0.2.5.9-rc): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes bug + 13471. This is a workaround for an OpenSSL bug. + + Changes in version 0.2.4.24 - 2014-09-22 Tor 0.2.4.24 fixes a bug that affects consistency and speed when connecting to hidden services, and it updates the location of one of

1 0

[tor/release-0.2.5] Better release blurb, maybe.
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit e6ae154ab4560083162715ccbd3d25231ae89ebe Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:55:51 2014 -0400 Better release blurb, maybe. --- ChangeLog | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 4396ee4..91a3e1e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,9 +1,9 @@ Changes in version 0.2.5.9-rc - 2014-10-20 Tor 0.2.5.9-rc is the third release candidate for the Tor 0.2.5.x - series. It contains a response to the recent "POODLE" attack against - SSL3 (which doesn't affect Tor), and a response to a crash bug caused - by some operating systems' response to the "POODLE" attack (which does - affect Tor). It also contains a few miscellaneous fixes. + series. It disables SSL3 in response to the recent "POODLE" attack + (even though POODLE does not affect Tor). It also works around a crash + bug caused by some operating systems' response to the "POODLE" attack + (which does affect Tor). It also contains a few miscellaneous fixes. o Major security fixes: - Disable support for SSLv3. All versions of OpenSSL in use with Tor

1 0

[tor/release-0.2.4] Remove a stray changes file.
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit b783ed3b5ca1e2682542e92119cb50b01e877709 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:53:02 2014 -0400 Remove a stray changes file. --- changes/disable_sslv3 | 4 ---- 1 file changed, 4 deletions(-) diff --git a/changes/disable_sslv3 b/changes/disable_sslv3 deleted file mode 100644 index bb4c2df..0000000 --- a/changes/disable_sslv3 +++ /dev/null @@ -1,4 +0,0 @@ - o Major security fixes: - - Disable support for SSLv3. All versions of OpenSSL in use with - Tor today support TLS 1.0 or later, so we can safely turn off - support for this old (and insecure) protocol. Fixes bug 13426.

1 0

[tor/release-0.2.4] better release blurb, maybe. Also bump version.
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit 7ce4192d1d5c4240bf87889bf5fe44f3f5702503 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:55:16 2014 -0400 better release blurb, maybe. Also bump version. --- ChangeLog | 8 ++++---- configure.ac | 2 +- contrib/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/ChangeLog b/ChangeLog index b4920ac..c3ca488 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,8 +1,8 @@ Changes in version 0.2.4.25 - 2014-10-20 - Tor 0.2.4.25 contains a response to the recent "POODLE" attack against - SSL3 (which doesn't affect Tor), and a response to a crash bug caused - by some operating systems' response to the "POODLE" attack (which does - affect Tor). + Tor 0.2.4.25 disables SSL3 in response to the recent "POODLE" attack + (even though POODLE does not affect Tor). It also works around a crash + bug caused by some operating systems' response to the "POODLE" attack + (which does affect Tor). o Major security fixes (also in 0.2.5.9-rc): - Disable support for SSLv3. All versions of OpenSSL in use with Tor diff --git a/configure.ac b/configure.ac index c05d8fd..2e1da5e 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2013, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.4.24]) +AC_INIT([tor],[0.2.4.25]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/tor-mingw.nsi.in b/contrib/tor-mingw.nsi.in index 029b9de..1ccc1e7 100644 --- a/contrib/tor-mingw.nsi.in +++ b/contrib/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.4.24" +!define VERSION "0.2.4.25" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index d9e4dab..c866bbb 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -241,7 +241,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.4.24" +#define VERSION "0.2.4.25"

1 0

[tor/release-0.2.4] Changelog for 0.2.4.25
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit 0c8acf11981999f119e0072ec61ce519e43b8dbb Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:43:09 2014 -0400 Changelog for 0.2.4.25 --- ChangeLog | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/ChangeLog b/ChangeLog index 0270959..b4920ac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,20 @@ +Changes in version 0.2.4.25 - 2014-10-20 + Tor 0.2.4.25 contains a response to the recent "POODLE" attack against + SSL3 (which doesn't affect Tor), and a response to a crash bug caused + by some operating systems' response to the "POODLE" attack (which does + affect Tor). + + o Major security fixes (also in 0.2.5.9-rc): + - Disable support for SSLv3. All versions of OpenSSL in use with Tor + today support TLS 1.0 or later, so we can safely turn off support + for this old (and insecure) protocol. Fixes bug 13426. + + o Major bugfixes (openssl bug workaround, also in 0.2.5.9-rc): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes bug + 13471. This is a workaround for an OpenSSL bug. + + Changes in version 0.2.4.24 - 2014-09-22 Tor 0.2.4.24 fixes a bug that affects consistency and speed when connecting to hidden services, and it updates the location of one of

1 0

[tor/release-0.2.5] Bump version to 0.2.5.9-rc
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit f69c7a152f0f139d51838087d8a63d4b66a603b0 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:45:59 2014 -0400 Bump version to 0.2.5.9-rc --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index e0cabc5..9e2b43d 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ dnl Copyright (c) 2004-2006, Roger Dingledine, Nick Mathewson dnl Copyright (c) 2007-2013, The Tor Project, Inc. dnl See LICENSE for licensing information -AC_INIT([tor],[0.2.5.8-rc]) +AC_INIT([tor],[0.2.5.9-rc]) AC_CONFIG_SRCDIR([src/or/main.c]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index c7058e1..81f963c 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.2.5.8-rc" +!define VERSION "0.2.5.9-rc" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 98b9d90..5fdf6db 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -241,7 +241,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.2.5.8-rc" +#define VERSION "0.2.5.9-rc"

1 0

[tor/release-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit 403c6ae78e2dff753d407273ce78c024a0ffb40d Merge: 943fd4a c1dd598 Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:39:48 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.3' into maint-0.2.4 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/release-0.2.5] Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit fd8f21e730ff2f9f8ace9951bf17fe357a0f8a27 Merge: ab4b296 403c6ae Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:40:07 2014 -0400 Merge remote-tracking branch 'origin/maint-0.2.4' into maint-0.2.5 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/release-0.2.5] Merge branch 'maint-0.2.5' into release-0.2.5
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit 095080360f1511d35fc62be8bc7c804fbcccbdc3 Merge: 9ffb2d8 fd8f21e Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 21:38:17 2014 -0400 Merge branch 'maint-0.2.5' into release-0.2.5 changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+)

1 0

[tor/release-0.2.5] Note that our #13426 fix is also a #13471 fix.
by nickm＠torproject.org 20 Oct '14

20 Oct '14

commit c1dd598df8972a6b7b8bdeff6a1549a7c171d7dc Author: Nick Mathewson <nickm(a)torproject.org> Date: Sun Oct 19 15:38:44 2014 -0400 Note that our #13426 fix is also a #13471 fix. See also http://marc.info/?l=openssl-dev&m=141357408522028&w=2 --- changes/bug13471 | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/changes/bug13471 b/changes/bug13471 new file mode 100644 index 0000000..c116a4a --- /dev/null +++ b/changes/bug13471 @@ -0,0 +1,5 @@ + o Major bugfixes (openssl bug workaround): + - Avoid crashing when using OpenSSL version 0.9.8zc, 1.0.0o, or + 1.0.1j, built with the 'no-ssl3' configuration option. Fixes + bug 13471. This is a workaround for an OpenSSL bug. +

1 0