tor-commits March 2021

tor-commits@lists.torproject.org

17 participants
2169 discussions

[tor/release-0.3.5] Bump to 0.3.5.14
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 1a0b5fd569684fc2d75436f7b3befcc5652c87e1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:39:45 2021 -0400 Bump to 0.3.5.14 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 44f96b6616..af3762d460 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.13-dev]) +AC_INIT([tor],[0.3.5.14]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index a4ddf8b46c..1f3f728aa0 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.5.13-dev" +!define VERSION "0.3.5.14" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 991369b9f9..9cab6cf3e3 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.5.13-dev" +#define VERSION "0.3.5.14"

1 0

[tor/master] Merge branch 'maint-0.4.5'
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit c306b0f5113ae8e3a0435a45448bf53cc094907b Merge: 2022d974af 7c00afe0fb Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:41:38 2021 -0400 Merge branch 'maint-0.4.5'

1 0

[tor/release-0.3.5] Fix detection of point to insert signatures on a pending consensus.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 890ae4fb1adfa13e37aaf5261e089e8c195a75cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Wed Mar 3 15:14:31 2021 -0500 Fix detection of point to insert signatures on a pending consensus. We were looking for the first instance of "directory-signature " when instead the correct behavior is to look for the first instance of "directory-signature " at the start of a line. Unfortunately, this can be exploited as to crash authorities while they're voting. Fixes #40316; bugfix on 0.2.2.4-alpha. This is TROVE-2021-002, also tracked as CVE-2021-28090. --- changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/changes/bug40316 b/changes/bug40316 new file mode 100644 index 0000000000..cd275b5c9c --- /dev/null +++ b/changes/bug40316 @@ -0,0 +1,5 @@ + o Major bugfixes (security, denial of service): + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. + Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as + TROVE-2021-002 and CVE-2021-28090. diff --git a/src/feature/dirauth/dirvote.c b/src/feature/dirauth/dirvote.c index af8b3dc207..9e01cee42a 100644 --- a/src/feature/dirauth/dirvote.c +++ b/src/feature/dirauth/dirvote.c @@ -3520,7 +3520,7 @@ dirvote_add_signatures_to_pending_consensus( strlen(pc->body) + strlen(new_signatures) + 1; pc->body = tor_realloc(pc->body, new_consensus_len); dst_end = pc->body + new_consensus_len; - dst = strstr(pc->body, "directory-signature "); + dst = (char *) find_str_at_start_of_line(pc->body, "directory-signature "); tor_assert(dst); strlcpy(dst, new_signatures, dst_end-dst);

1 0

[tor/release-0.4.4] Disable the dump_desc() function.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit ede88c374cd61e1e362422718625707a770cffff Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 19 12:31:19 2021 -0500 Disable the dump_desc() function. It can be called with strings that should have been length-delimited, but which in fact are not. This can cause a CPU-DoS bug or, in a worse case, a crash. Since this function isn't essential, the best solution for older Tors is to just turn it off. Fixes bug 40286; bugfix on 0.2.2.1-alpha when dump_desc() was introduced. --- changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal new file mode 100644 index 0000000000..b8669debaa --- /dev/null +++ b/changes/ticket40286_minimal @@ -0,0 +1,5 @@ + o Major bugfixes (denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. + Fixes bug 40286; bugfix on 0.2.2.1-alpha. diff --git a/src/feature/dirparse/unparseable.c b/src/feature/dirparse/unparseable.c index 941b5a1f6d..a547335452 100644 --- a/src/feature/dirparse/unparseable.c +++ b/src/feature/dirparse/unparseable.c @@ -492,6 +492,12 @@ dump_desc,(const char *desc, const char *type)) { tor_assert(desc); tor_assert(type); +#ifndef TOR_UNIT_TESTS + /* On older versions of Tor we are disabling this function, since it + * can be called with strings that are far too long. */ + if (1) + return; +#endif size_t len; /* The SHA256 of the string */ uint8_t digest_sha256[DIGEST256_LEN];

1 0

[tor/release-0.4.4] Merge branch 'bug40286_disable_min_035' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f46f4562cf6f47fe6c00752f61b04dc18a454253 Merge: 1a0b5fd569 ede88c374c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:41:03 2021 -0400 Merge branch 'bug40286_disable_min_035' into maint-0.3.5 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 8ada4263a95b2a5bc6ef6022664aadca14039d97 Merge: 9f59b6f458 1a0b5fd569 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:40:06 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 "ours" to avoid version bump.

1 0

[tor/release-0.4.4] Bump to 0.3.5.14
by nickm＠torproject.org 16 Mar '21

16 Mar '21

1 0

[tor/release-0.3.5] Copy 0.3.5.14 changelog to releasenotes
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 50d4300e77ea2f8f7d17aade1b9f32f38cffbcde Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 08:30:27 2021 -0400 Copy 0.3.5.14 changelog to releasenotes --- ReleaseNotes | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index a833379509..6a2e8fc7a8 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,54 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.3.5.14 - 2021-03-16 + Tor 0.3.5.14 backports fixes for two important denial-of-service bugs + in earlier versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a + compatibility issue. + + o Major bugfixes (security, denial of service, backport from 0.4.5.7): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data, backport from 0.4.5.7): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing terms, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Removed features (mallinfo deprecated, backport from 0.4.5.7): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.3.5.13 - 2020-02-03 Tor 0.3.5.13 backports numerous bugfixes from later releases, including one that made v3 onion services more susceptible to

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit ecf1ba974621f954368a3d3d0232b8094a15e745 Merge: b3c891119c 5ec579610a Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.4] Merge branch 'maint-0.4.4' into release-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit c63e09043a357c2bf39f37433baa18b365309869 Merge: 1a407612bc fb2c889a38 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:42:55 2021 -0400 Merge branch 'maint-0.4.4' into release-0.4.4 configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits March 2021