tor-commits March 2021

tor-commits@lists.torproject.org

17 participants
2169 discussions

[tor/release-0.4.5] Remove check-best-practices from check-local in 0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f2cfd1ffad439350e907483255c150360ea37108 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:41:19 2021 -0400 Remove check-best-practices from check-local in 0.4.4 --- Makefile.am | 1 - 1 file changed, 1 deletion(-) diff --git a/Makefile.am b/Makefile.am index a723c167ef..a212ae19c6 100644 --- a/Makefile.am +++ b/Makefile.am @@ -275,7 +275,6 @@ check-local: \ check-spaces \ check-changes \ check-includes \ - check-best-practices \ shellcheck # test-network requires a copy of Chutney in $CHUTNEY_PATH.

1 0

[tor/release-0.4.5] changelog updates from arma
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit bc2e3ea89d321dde9d024430561cffd6a13c6900 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 17:12:55 2021 -0400 changelog updates from arma --- ChangeLog | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 57480c08aa..a2052fa55f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,7 +34,7 @@ Changes in version 0.4.5.7 - 2021-03-16 o Minor features (geoip data): - We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed - their licensing term, so we were unable to update them after that + their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the @@ -73,7 +73,7 @@ Changes in version 0.4.5.7 - 2021-03-16 - Remove a spammy log notice falsely claiming that the IPv4/v6 address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. - Do not query the address cache early in the boot process when - deciding if we a relay needs to fetch early directory information + deciding if a relay needs to fetch early directory information from an authority. This bug resulted in a relay falsely believing it didn't have an address and thus triggering an authority fetch at each boot. Related to our fix for 40300.

1 0

[tor/release-0.4.5] copy 0.4.5.7 changelog to releasenotes
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 83f895c015de55201e5f226f84a866f30f5ee14b Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 08:27:52 2021 -0400 copy 0.4.5.7 changelog to releasenotes --- ReleaseNotes | 85 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index 47a673b90a..0b0e0912b1 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,91 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.4.5.7 - 2021-03-16 + Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier + versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a few + smaller bugs in earlier releases. + + o Major bugfixes (security, denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing terms, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Minor bugfixes (directory authority): + - Now that exit relays don't allow exit connections to directory + authority DirPorts (to prevent network reentry), disable + authorities' reachability self test on the DirPort. Fixes bug + 40287; bugfix on 0.4.5.5-rc. + + o Minor bugfixes (documentation): + - Fix a formatting error in the documentation for + VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha. + + o Minor bugfixes (Linux, relay): + - Fix a bug in determining total available system memory that would + have been triggered if the format of Linux's /proc/meminfo file + had ever changed to include "MemTotal:" in the middle of a line. + Fixes bug 40315; bugfix on 0.2.5.4-alpha. + + o Minor bugfixes (metrics port): + - Fix a BUG() warning on the MetricsPort for an internal missing + handler. Fixes bug 40295; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (onion service): + - Remove a harmless BUG() warning when reloading tor configured with + onion services. Fixes bug 40334; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (portability): + - Fix a non-portable usage of "==" with "test" in the configure + script. Fixes bug 40298; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (relay): + - Remove a spammy log notice falsely claiming that the IPv4/v6 + address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. + - Do not query the address cache early in the boot process when + deciding if a relay needs to fetch early directory information + from an authority. This bug resulted in a relay falsely believing + it didn't have an address and thus triggering an authority fetch + at each boot. Related to our fix for 40300. + + o Removed features (mallinfo deprecated): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.4.5.6 - 2021-02-15 The Tor 0.4.5.x release series is dedicated to the memory of Karsten Loesing (1979-2020), Tor developer, cypherpunk, husband, and father.

1 0

[tor/release-0.4.5] Changelog for 0.4.5.7
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 066de45209f28d69f3ad0046e1d3122ae15364bc Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:22:06 2021 -0400 Changelog for 0.4.5.7 --- ChangeLog | 85 +++++++++++++++++++++++++++++++++++++++++++++ changes/bug40256_045 | 3 -- changes/bug40287 | 4 --- changes/bug40298 | 3 -- changes/bug40315 | 5 --- changes/bug40316 | 5 --- changes/geoip-2021-03-12 | 9 ----- changes/ticket40286_minimal | 6 ---- changes/ticket40295 | 3 -- changes/ticket40300 | 8 ----- changes/ticket40309 | 3 -- changes/ticket40334 | 3 -- 12 files changed, 85 insertions(+), 52 deletions(-) diff --git a/ChangeLog b/ChangeLog index c91d716c98..57480c08aa 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,88 @@ +Changes in version 0.4.5.7 - 2021-03-16 + Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier + versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a few + smaller bugs in earlier releases. + + o Major bugfixes (security, denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing term, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Minor bugfixes (directory authority): + - Now that exit relays don't allow exit connections to directory + authority DirPorts (to prevent network reentry), disable + authorities' reachability self test on the DirPort. Fixes bug + 40287; bugfix on 0.4.5.5-rc. + + o Minor bugfixes (documentation): + - Fix a formatting error in the documentation for + VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha. + + o Minor bugfixes (Linux, relay): + - Fix a bug in determining total available system memory that would + have been triggered if the format of Linux's /proc/meminfo file + had ever changed to include "MemTotal:" in the middle of a line. + Fixes bug 40315; bugfix on 0.2.5.4-alpha. + + o Minor bugfixes (metrics port): + - Fix a BUG() warning on the MetricsPort for an internal missing + handler. Fixes bug 40295; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (onion service): + - Remove a harmless BUG() warning when reloading tor configured with + onion services. Fixes bug 40334; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (portability): + - Fix a non-portable usage of "==" with "test" in the configure + script. Fixes bug 40298; bugfix on 0.4.5.1-alpha. + + o Minor bugfixes (relay): + - Remove a spammy log notice falsely claiming that the IPv4/v6 + address was missing. Fixes bug 40300; bugfix on 0.4.5.1-alpha. + - Do not query the address cache early in the boot process when + deciding if we a relay needs to fetch early directory information + from an authority. This bug resulted in a relay falsely believing + it didn't have an address and thus triggering an authority fetch + at each boot. Related to our fix for 40300. + + o Removed features (mallinfo deprecated): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.4.5.6 - 2021-02-15 The Tor 0.4.5.x release series is dedicated to the memory of Karsten Loesing (1979-2020), Tor developer, cypherpunk, husband, and father. diff --git a/changes/bug40256_045 b/changes/bug40256_045 deleted file mode 100644 index 14e67659e0..0000000000 --- a/changes/bug40256_045 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (documentation): - - Fix a formatting error on the documentation for - VirtualAddrNetworkIPv6. Fixes bug 40256; bugfix on 0.2.9.4-alpha. diff --git a/changes/bug40287 b/changes/bug40287 deleted file mode 100644 index 5a9c899d52..0000000000 --- a/changes/bug40287 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor bugfixes (directory authority): - - Now that exit relays don't allow exit connections to directory authority - DirPorts (network reentry), disable authorities' reachability self test - on the DirPort. Fixes bug 40287; bugfix on 0.4.5.5-rc. diff --git a/changes/bug40298 b/changes/bug40298 deleted file mode 100644 index 8b8b0bbc12..0000000000 --- a/changes/bug40298 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (portability): - - Fix a non-portable usage of "==" with "test" in the configure script. - Fixes bug 40298; bugfix on 0.4.5.1-alpha. diff --git a/changes/bug40315 b/changes/bug40315 deleted file mode 100644 index 9e9c740d96..0000000000 --- a/changes/bug40315 +++ /dev/null @@ -1,5 +0,0 @@ - o Minor bugfixes (Linux, relay): - - Fix a bug in determining total available system memory that would have - been triggered if the format of /proc/meminfo had ever changed - to include "MemTotal:" in the middle of a line. Fixes bug 40315; - bugfix on 0.2.5.4-alpha. diff --git a/changes/bug40316 b/changes/bug40316 deleted file mode 100644 index cd275b5c9c..0000000000 --- a/changes/bug40316 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, denial of service): - - Fix a bug in appending detached signatures to a pending consensus - document that could be used to crash a directory authority. - Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as - TROVE-2021-002 and CVE-2021-28090. diff --git a/changes/geoip-2021-03-12 b/changes/geoip-2021-03-12 deleted file mode 100644 index 01c1b0f162..0000000000 --- a/changes/geoip-2021-03-12 +++ /dev/null @@ -1,9 +0,0 @@ - o Minor features (geoip data): - - We have switched geoip data sources. Previously we shipped - IP-to-country mappings from Maxmind's GeoLite2, but in 2019 they - changed their licensing term, so we were unable to update them after - that point. We now ship geoip files based on the IPFire Location - Database instead. (See https://location.ipfire.org/ for more - information). This release updates our geoip files to match the - IPFire Location Database as retrieved on 2021/03/12. Closes - ticket 40224. diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal deleted file mode 100644 index 6a04ca79eb..0000000000 --- a/changes/ticket40286_minimal +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, denial of service): - - Disable the dump_desc() function that we used to dump unparseable - information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. Fixes bug 40286; - bugfix on 0.2.2.1-alpha. This bug is also tracked as - TROVE-2021-001 and CVE-2021-28089. diff --git a/changes/ticket40295 b/changes/ticket40295 deleted file mode 100644 index e6dba80120..0000000000 --- a/changes/ticket40295 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (metrics port): - - Fix a BUG() on the MetricsPort for an internal missing handler. Fixes bug - 40295; bugfix on 0.4.5.1-alpha. diff --git a/changes/ticket40300 b/changes/ticket40300 deleted file mode 100644 index b772ff60a4..0000000000 --- a/changes/ticket40300 +++ /dev/null @@ -1,8 +0,0 @@ - o Minor bugfixes (relay): - - Remove a spammy log notice that should not have been indicating the - operator that its IPv4/v6 was missing but it was not. Fixes bug 40300; - bugfix on 0.4.5.1-alpha. - - Do not query the address cache early in the boot process when deciding - if we a relay needs to fetch early directory information from an - authority. This resulted in a relay falsely believing it didn't have an - address and thus triggering an authority fetch at each boot. diff --git a/changes/ticket40309 b/changes/ticket40309 deleted file mode 100644 index 087ac36a4f..0000000000 --- a/changes/ticket40309 +++ /dev/null @@ -1,3 +0,0 @@ - o New system requirements (mallinfo() deprecated): - - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. Closes - ticket 40309. diff --git a/changes/ticket40334 b/changes/ticket40334 deleted file mode 100644 index c1c34384a0..0000000000 --- a/changes/ticket40334 +++ /dev/null @@ -1,3 +0,0 @@ - o Minor bugfixes (onion service): - - Remove a harmless BUG() warning when reloading tor configured with onion - services. Fixes bug 40334; bugfix on 0.4.5.1-alpha.

1 0

[tor/master] Merge branch 'bug40316_035_v2' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f078aab71ef56e1942caec5f27e0f336f2a7c7d1 Merge: efca9ce41c 890ae4fb1a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:58:54 2021 -0400 Merge branch 'bug40316_035_v2' into maint-0.3.5 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Merge branch 'maint-0.4.5'
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 3268403ba1fac9366575f4511b9f46d2b7738039 Merge: cfeb063f24 61731e3550 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.4.5' changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/master] Fix detection of point to insert signatures on a pending consensus.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 890ae4fb1adfa13e37aaf5261e089e8c195a75cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 3 15:14:31 2021 -0500 Fix detection of point to insert signatures on a pending consensus. We were looking for the first instance of "directory-signature " when instead the correct behavior is to look for the first instance of "directory-signature " at the start of a line. Unfortunately, this can be exploited as to crash authorities while they're voting. Fixes #40316; bugfix on 0.2.2.4-alpha. This is TROVE-2021-002, also tracked as CVE-2021-28090. --- changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40316 b/changes/bug40316 new file mode 100644 index 0000000000..cd275b5c9c --- /dev/null +++ b/changes/bug40316 @@ -0,0 +1,5 @@ + o Major bugfixes (security, denial of service): + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. + Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as + TROVE-2021-002 and CVE-2021-28090. diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index af8b3dc207..9e01cee42a 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( strlen(pc->body) + strlen(new_signatures) + 1; pc->body = tor_realloc(pc->body, new_consensus_len); dst_end = pc->body + new_consensus_len; - dst = strstr(pc->body, "directory-signature "); + dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature "); tor_assert(dst); strlcpy(dst, new_signatures, dst_end-dst);

1 0

[tor/master] Fold ticket40314 into ChangeLog.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 2022d974af6201c64dd5cc2e054bead5735e9531 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:35:40 2021 -0400 Fold ticket40314 into ChangeLog. --- ChangeLog | 10 +++++++++- changes/ticket40314 | 4 ---- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/ChangeLog b/ChangeLog index 965f2001d8..eea5d88b60 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,9 +1,12 @@ -Changes in version 0.4.6.1-alpha - 2021-03-?? +Changes in version 0.4.6.1-alpha - 2021-03-18 Tor 0.4.6.1-alpha is the first alpha release in the 0.4.6.x series. It improves client circuit performance, adds missing features, and improves some of our DoS handling and statistics reporting. It also includes numerous smaller bugfixes. + Below are the changes since 0.4.5.7. (Note that this release DOES + include the fixes for the security bugs already fixed in 0.4.5.7.) + o Major features (control port, onion services): - Add controller support for creating version 3 onion services with client authorization. Previously, only v2 onion services could be @@ -101,6 +104,11 @@ Changes in version 0.4.6.1-alpha - 2021-03-?? versions of python. Closes ticket 40213. Patch from Samanta Navarro. + o Minor features (vote document): + - Add a "stats" line to directory authority votes, to report various + statistics that authorities computed about the relays. This will + help us diagnose the network better. Closes ticket 40314. + o Minor bugfixes (build): - Mini-report in the configure script now shows whether or not lzma and zstd have been used, not just if enable flag passed in. Fixes diff --git a/changes/ticket40314 b/changes/ticket40314 deleted file mode 100644 index 328687c265..0000000000 --- a/changes/ticket40314 +++ /dev/null @@ -1,4 +0,0 @@ - o Minor feature (Vote document): - - Add the "stats" line in a directory authority vote in order to report - various statistics that the authority has computed for the relays. This - will help us diagnose better the network. Close ticket 40314.

1 0

[tor/master] Remove check-best-practices from check-local in 0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

1 0

[tor/master] Remove changes files that will appear in 0.4.5.7
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit fcd42982b2b8471e68d220504a3de5a30f3b9110 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:03:37 2021 -0400 Remove changes files that will appear in 0.4.5.7 (0.4.6.1-alpha will come out after the stable releases.) --- changes/bug40316 | 5 ----- changes/geoip-2021-03-12 | 9 --------- changes/ticket40286_minimal | 6 ------ 3 files changed, 20 deletions(-) diff --git a/changes/bug40316 b/changes/bug40316 deleted file mode 100644 index cd275b5c9c..0000000000 --- a/changes/bug40316 +++ /dev/null @@ -1,5 +0,0 @@ - o Major bugfixes (security, denial of service): - - Fix a bug in appending detached signatures to a pending consensus - document that could be used to crash a directory authority. - Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as - TROVE-2021-002 and CVE-2021-28090. diff --git a/changes/geoip-2021-03-12 b/changes/geoip-2021-03-12 deleted file mode 100644 index 01c1b0f162..0000000000 --- a/changes/geoip-2021-03-12 +++ /dev/null @@ -1,9 +0,0 @@ - o Minor features (geoip data): - - We have switched geoip data sources. Previously we shipped - IP-to-country mappings from Maxmind's GeoLite2, but in 2019 they - changed their licensing term, so we were unable to update them after - that point. We now ship geoip files based on the IPFire Location - Database instead. (See https://location.ipfire.org/ for more - information). This release updates our geoip files to match the - IPFire Location Database as retrieved on 2021/03/12. Closes - ticket 40224. diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal deleted file mode 100644 index 6a04ca79eb..0000000000 --- a/changes/ticket40286_minimal +++ /dev/null @@ -1,6 +0,0 @@ - o Major bugfixes (security, denial of service): - - Disable the dump_desc() function that we used to dump unparseable - information to disk. It was called incorrectly in several places, - in a way that could lead to excessive CPU usage. Fixes bug 40286; - bugfix on 0.2.2.1-alpha. This bug is also tracked as - TROVE-2021-001 and CVE-2021-28089.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits March 2021