tor-commits March 2021

tor-commits@lists.torproject.org

17 participants
2169 discussions

[tor/release-0.4.4] changelog updates from arma
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit e8f7b22fa53d8b5fcf97560bbe92c3c7522c3b37 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 17:12:46 2021 -0400 changelog updates from arma --- ChangeLog | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 0c1ab37587..2fffea1233 100644 --- a/ChangeLog +++ b/ChangeLog @@ -34,7 +34,7 @@ Changes in version 0.4.4.8 - 2021-03-16 o Minor features (geoip data, backport from 0.4.5.7): - We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed - their licensing term, so we were unable to update them after that + their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the

1 0

[tor/release-0.4.4] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 5ec579610ace4d3e4f0a6432b26e1e968beccf36 Merge: 2eb900f7e2 f078aab71e Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 09:01:59 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/bug40316 | 5 +++++ src/feature/dirauth/dirvote.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-)

1 0

[tor/release-0.4.4] Copy 0.4.4.8 changelog to releasenotes
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit fecc19529452fcd682272768f17147f4eed360a7 Author: Nick Mathewson <nickm(a)torproject.org> Date: Tue Mar 16 08:28:50 2021 -0400 Copy 0.4.4.8 changelog to releasenotes --- ReleaseNotes | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/ReleaseNotes b/ReleaseNotes index a4ee81d41e..b405c0444b 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,6 +2,54 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. +Changes in version 0.4.4.8 - 2021-03-16 + Tor 0.4.4.8 backports fixes for two important denial-of-service bugs + in earlier versions of Tor. + + One of these vulnerabilities (TROVE-2021-001) would allow an attacker + who can send directory data to a Tor instance to force that Tor + instance to consume huge amounts of CPU. This is easiest to exploit + against authorities, since anybody can upload to them, but directory + caches could also exploit this vulnerability against relays or clients + when they download. The other vulnerability (TROVE-2021-002) only + affects directory authorities, and would allow an attacker to remotely + crash the authority with an assertion failure. Patches have already + been provided to the authority operators, to help ensure + network stability. + + We recommend that everybody upgrade to one of the releases that fixes + these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available + to you. + + This release also updates our GeoIP data source, and fixes a + compatibility issue. + + o Major bugfixes (security, denial of service, backport from 0.4.5.7): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. Fixes bug 40286; + bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- + 001 and CVE-2021-28089. + - Fix a bug in appending detached signatures to a pending consensus + document that could be used to crash a directory authority. Fixes + bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 + and CVE-2021-28090. + + o Minor features (geoip data, backport from 0.4.5.7): + - We have switched geoip data sources. Previously we shipped IP-to- + country mappings from Maxmind's GeoLite2, but in 2019 they changed + their licensing terms, so we were unable to update them after that + point. We now ship geoip files based on the IPFire Location + Database instead. (See https://location.ipfire.org/ for more + information). This release updates our geoip files to match the + IPFire Location Database as retrieved on 2021/03/12. Closes + ticket 40224. + + o Removed features (mallinfo deprecated, backport from 0.4.5.7): + - Remove mallinfo() usage entirely. Libc 2.33+ now deprecates it. + Closes ticket 40309. + + Changes in version 0.4.4.7 - 2021-02-03 Tor 0.4.4.7 backports numerous bugfixes from later releases, including one that made v3 onion services more susceptible to

1 0

[tor/release-0.4.5] Disable the dump_desc() function.
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit ede88c374cd61e1e362422718625707a770cffff Author: Nick Mathewson <nickm(a)torproject.org> Date: Fri Feb 19 12:31:19 2021 -0500 Disable the dump_desc() function. It can be called with strings that should have been length-delimited, but which in fact are not. This can cause a CPU-DoS bug or, in a worse case, a crash. Since this function isn't essential, the best solution for older Tors is to just turn it off. Fixes bug 40286; bugfix on 0.2.2.1-alpha when dump_desc() was introduced. --- changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/changes/ticket40286_minimal b/changes/ticket40286_minimal new file mode 100644 index 0000000000..b8669debaa --- /dev/null +++ b/changes/ticket40286_minimal @@ -0,0 +1,5 @@ + o Major bugfixes (denial of service): + - Disable the dump_desc() function that we used to dump unparseable + information to disk. It was called incorrectly in several places, + in a way that could lead to excessive CPU usage. + Fixes bug 40286; bugfix on 0.2.2.1-alpha. diff --git a/src/feature/dirparse/unparseable.c b/src/feature/dirparse/unparseable.c index 941b5a1f6d..a547335452 100644 --- a/src/feature/dirparse/unparseable.c +++ b/src/feature/dirparse/unparseable.c @@ -492,6 +492,12 @@ dump_desc,(const char *desc, const char *type)) { tor_assert(desc); tor_assert(type); +#ifndef TOR_UNIT_TESTS + /* On older versions of Tor we are disabling this function, since it + * can be called with strings that are far too long. */ + if (1) + return; +#endif size_t len; /* The SHA256 of the string */ uint8_t digest_sha256[DIGEST256_LEN];

1 0

[tor/release-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.4
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit b9f65390089817a74bf20d93e93a15b41a970f79 Merge: fb2c889a38 f46f4562cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:52:28 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.4 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.4' into maint-0.4.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 7c5a67ccd983bb028d21a5e8aa48b4cd9d6a8a1c Merge: be17a5a3cf b9f6539008 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:52:29 2021 -0400 Merge branch 'maint-0.4.4' into maint-0.4.5 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.4.5] Merge branch 'bug40286_disable_min_035' into maint-0.3.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit f46f4562cf6f47fe6c00752f61b04dc18a454253 Merge: 1a0b5fd569 ede88c374c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:41:03 2021 -0400 Merge branch 'bug40286_disable_min_035' into maint-0.3.5 changes/ticket40286_minimal | 5 +++++ src/feature/dirparse/unparseable.c | 6 ++++++ 2 files changed, 11 insertions(+)

1 0

[tor/release-0.4.5] Bump to 0.3.5.14
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 1a0b5fd569684fc2d75436f7b3befcc5652c87e1 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:39:45 2021 -0400 Bump to 0.3.5.14 --- configure.ac | 2 +- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/configure.ac b/configure.ac index 44f96b6616..af3762d460 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.13-dev]) +AC_INIT([tor],[0.3.5.14]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4]) diff --git a/contrib/win32build/tor-mingw.nsi.in b/contrib/win32build/tor-mingw.nsi.in index a4ddf8b46c..1f3f728aa0 100644 --- a/contrib/win32build/tor-mingw.nsi.in +++ b/contrib/win32build/tor-mingw.nsi.in @@ -8,7 +8,7 @@ !include "LogicLib.nsh" !include "FileFunc.nsh" !insertmacro GetParameters -!define VERSION "0.3.5.13-dev" +!define VERSION "0.3.5.14" !define INSTALLER "tor-${VERSION}-win32.exe" !define WEBSITE "https://www.torproject.org/" !define LICENSE "LICENSE" diff --git a/src/win32/orconfig.h b/src/win32/orconfig.h index 991369b9f9..9cab6cf3e3 100644 --- a/src/win32/orconfig.h +++ b/src/win32/orconfig.h @@ -218,7 +218,7 @@ #define USING_TWOS_COMPLEMENT /* Version number of package */ -#define VERSION "0.3.5.13-dev" +#define VERSION "0.3.5.14"

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 9c63b3b0c22f67e059d9c9dcb22ce0d8efc0512a Merge: 1fdfa8eeed a6533af9e8 Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 08:54:00 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 changes/ticket40286_minimal | 7 ++++--- src/feature/dirparse/unparseable.c | 7 +++++-- 2 files changed, 9 insertions(+), 5 deletions(-)

1 0

[tor/release-0.4.5] Merge branch 'maint-0.4.5' into release-0.4.5
by nickm＠torproject.org 16 Mar '21

16 Mar '21

commit 849fde27fe6555fd28400a4a00996899ee6983c1 Merge: 61c6049fa8 be17a5a3cf Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Mar 15 07:42:55 2021 -0400 Merge branch 'maint-0.4.5' into release-0.4.5 configure.ac | 4 ++-- contrib/win32build/tor-mingw.nsi.in | 2 +- src/win32/orconfig.h | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

tor-commits March 2021