August 2021 - tor-commits - lists.torproject.org

[tor/main] Bump version to -dev
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit a8ce645ab04928585d1bd131fa4eb7a5787b9ca7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:33:58 2021 -0400 Bump version to -dev Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index c45b76e5a6..e698bf8901 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.16]) +AC_INIT([tor],[0.3.5.16-dev]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4])

1 0

[tor/maint-0.3.5] Bump version to -dev
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit a8ce645ab04928585d1bd131fa4eb7a5787b9ca7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:33:58 2021 -0400 Bump version to -dev Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index c45b76e5a6..e698bf8901 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.16]) +AC_INIT([tor],[0.3.5.16-dev]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4])

1 0

[tor/main] Merge branch 'maint-0.4.6'
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit 50e32a54d1c05e6d34b60de5d082812c4bc7ca59 Merge: 168ea275b8 2be49cdbe5 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:34:49 2021 -0400 Merge branch 'maint-0.4.6'

1 0

[tor/maint-0.4.5] Merge branch 'maint-0.3.5' into maint-0.4.5
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit da9ff3936d71a607a7af5b07f87d18a4aa303060 Merge: 18f2a7c012 a8ce645ab0 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:34:19 2021 -0400 Merge branch 'maint-0.3.5' into maint-0.4.5

1 0

[tor/maint-0.4.5] Bump version to -dev
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit a8ce645ab04928585d1bd131fa4eb7a5787b9ca7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:33:58 2021 -0400 Bump version to -dev Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index c45b76e5a6..e698bf8901 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.16]) +AC_INIT([tor],[0.3.5.16-dev]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4])

1 0

[tor/maint-0.4.5] Bump version to -dev
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit 18f2a7c0129b1b7251aae3cf34c349ecc3d416b4 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:34:10 2021 -0400 Bump version to -dev Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 14ce94db87..0102304fd2 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.4.5.10]) +AC_INIT([tor],[0.4.5.10-dev]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4])

1 0

[tor/maint-0.4.6] Bump version to -dev
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit a8ce645ab04928585d1bd131fa4eb7a5787b9ca7 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 16:33:58 2021 -0400 Bump version to -dev Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- configure.ac | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index c45b76e5a6..e698bf8901 100644 --- a/configure.ac +++ b/configure.ac @@ -4,7 +4,7 @@ dnl Copyright (c) 2007-2019, The Tor Project, Inc. dnl See LICENSE for licensing information AC_PREREQ([2.63]) -AC_INIT([tor],[0.3.5.16]) +AC_INIT([tor],[0.3.5.16-dev]) AC_CONFIG_SRCDIR([src/app/main/tor_main.c]) AC_CONFIG_MACRO_DIR([m4])

1 0

[tpo/master] Latest stable is 0.4.6.7
by nickm＠torproject.org 16 Aug '21

16 Aug '21

commit 0ee4a5c30c3c56acb8ab5345b196c892d1dc7c9c Author: Nick Mathewson <nickm(a)torproject.org> Date: Mon Aug 16 16:18:01 2021 -0400 Latest stable is 0.4.6.7 --- databags/versions.ini | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/databags/versions.ini b/databags/versions.ini index e6dfb307..f05ff434 100644 --- a/databags/versions.ini +++ b/databags/versions.ini @@ -21,7 +21,7 @@ version = 11.0a3 version = 11.0a2 [tor-stable] -version = 0.4.6.6 +version = 0.4.6.7 [tor-alpha] version = 0.4.6.4-rc

1 0

[tor/release-0.3.5] changelog: Run format_changelog.py
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit 15139a1c00124a6e9a65999ee25af01f890d7c3c Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 15:27:26 2021 -0400 changelog: Run format_changelog.py Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- ChangeLog | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/ChangeLog b/ChangeLog index aa7cfcacc7..ba5bb7ed53 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,8 +1,8 @@ Changes in version 0.3.5.16 - 2021-08-16 - This version fixes several bugs from earlier versions of Tor, including one - that could lead to a denial-of-service attack. Everyone running an earlier - version, whether as a client, a relay, or an onion service, should upgrade - to Tor 0.3.5.16, 0.4.5.10, or 0.4.6.7. + This version fixes several bugs from earlier versions of Tor, + including one that could lead to a denial-of-service attack. Everyone + running an earlier version, whether as a client, a relay, or an onion + service, should upgrade to Tor 0.3.5.16, 0.4.5.10, or 0.4.6.7. o Major bugfixes (cryptography, security): - Resolve an assertion failure caused by a behavior mismatch between @@ -17,16 +17,17 @@ Changes in version 0.3.5.16 - 2021-08-16 - Regenerate fallback directories list. Close ticket 40447. o Minor features (geoip data): - - Update the geoip files to match the IPFire Location Database, - as retrieved on 2021/08/12. + - Update the geoip files to match the IPFire Location Database, as + retrieved on 2021/08/12. o Minor bugfix (crypto, backport from 0.4.6.7): - - Disable the unused batch verification feature of ed25519-donna. Fixes - bug 40078; bugfix on 0.2.6.1-alpha. Found by Henry de Valence. + - Disable the unused batch verification feature of ed25519-donna. + Fixes bug 40078; bugfix on 0.2.6.1-alpha. Found by Henry + de Valence. o Minor bugfixes (relay, backport from 0.4.6.7): - - Reduce the compression level for data streaming from HIGH to LOW. Fixes - bug 40301; bugfix on 0.3.5.1-alpha. + - Reduce the compression level for data streaming from HIGH to LOW. + Fixes bug 40301; bugfix on 0.3.5.1-alpha. Changes in version 0.3.5.15 - 2021-06-14

1 0

[tor/release-0.3.5] changelog: Update with security fix stanza
by dgoulet＠torproject.org 16 Aug '21

16 Aug '21

commit 59c522b964024dd4bf616989966223f0b6165220 Author: David Goulet <dgoulet(a)torproject.org> Date: Mon Aug 16 11:53:34 2021 -0400 changelog: Update with security fix stanza Signed-off-by: David Goulet <dgoulet(a)torproject.org> --- ChangeLog | 14 +++++++++++++- ReleaseNotes | 16 ++++++++++++++-- 2 files changed, 27 insertions(+), 3 deletions(-) diff --git a/ChangeLog b/ChangeLog index f4e7006ecc..aa7cfcacc7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,17 @@ Changes in version 0.3.5.16 - 2021-08-16 - This version fixes several bugs from earlier versions. + This version fixes several bugs from earlier versions of Tor, including one + that could lead to a denial-of-service attack. Everyone running an earlier + version, whether as a client, a relay, or an onion service, should upgrade + to Tor 0.3.5.16, 0.4.5.10, or 0.4.6.7. + + o Major bugfixes (cryptography, security): + - Resolve an assertion failure caused by a behavior mismatch between + our batch-signature verification code and our single-signature + verification code. This assertion failure could be triggered + remotely, leading to a denial of service attack. We fix this issue + by disabling batch verification. Fixes bug 40078; bugfix on + 0.2.6.1-alpha. This issue is also tracked as TROVE-2021-007 and + CVE-2021-38385. Found by Henry de Valence. o Minor feature (fallbackdir): - Regenerate fallback directories list. Close ticket 40447. diff --git a/ReleaseNotes b/ReleaseNotes index b508b6dc8a..77b9047761 100644 --- a/ReleaseNotes +++ b/ReleaseNotes @@ -2,8 +2,20 @@ This document summarizes new features and bugfixes in each stable release of Tor. If you want to see more detailed descriptions of the changes in each development snapshot, see the ChangeLog file. -Changes in version 0.3.5.16 - 2021-08-13 - This version fixes several bugs from earlier versions. +Changes in version 0.3.5.16 - 2021-08-16 + This version fixes several bugs from earlier versions of Tor, including one + that could lead to a denial-of-service attack. Everyone running an earlier + version, whether as a client, a relay, or an onion service, should upgrade + to Tor 0.3.5.16, 0.4.5.10, or 0.4.6.7. + + o Major bugfixes (cryptography, security): + - Resolve an assertion failure caused by a behavior mismatch between our + batch-signature verification code and our single-signature verification + code. This assertion failure could be triggered remotely, leading to a + denial of service attack. We fix this issue by disabling batch + verification. Fixes bug 40078; bugfix on 0.2.6.1-alpha. This issue is + also tracked as TROVE-2021-007 and CVE-2021-38385. Found by Henry de + Valence. o Minor feature (fallbackdir): - Regenerate fallback directories list. Close ticket 40447.

1 0