tor-packagers

tor-packagers@lists.torproject.org

February 2019

1 participants
2 discussions

New source releases: Tor 0.3.3.12, 0.3.4.11, 0.3.5.8, 0.4.0.2-alpha
by Nick Mathewson 21 Feb '19

21 Feb '19

Hello! There are new releases available at https://dist.torproject.org/ ; please remember to check the signatures. These releases fix TROVE-2019-001, a possible security bug involving the KIST cell scheduler code in versions 0.3.2.1-alpha and later. We are not certain that it is possible to exploit this bug in the wild, but out of an abundence caution, we recommend that all affected users upgrate. The potential impact is a remote denial-of-service attack against clients or relays. Please remember that 0.3.3.12 is is our last anticipated release in the 0.3.3.x series; support for that series will end next week. Other current supported stable release series are: 0.2.9.x (long term support, end of life at Jan 1, 2020) 0.3.4.x (end-of-life at June 10, 2019) 0.3.5.x (long-term support, end of life at Feb 1, 2022) 0.4.0.x (currently in alpha; planned to be stable in April 2019 and supported until at least Jan 2020) You can find all of the changelogs at: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.3.12 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.4.11 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.5.8 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.0.2-alpha I'll be sending out an official announcement soon. yrs, -- Nick

1 0

Fwd: Upcoming stable releases to fix a medium-severity security issue
by Nick Mathewson 20 Feb '19

20 Feb '19

---------- Forwarded message --------- From: Nick Mathewson <nickm(a)torproject.org> Date: Wed, Feb 20, 2019 at 12:29 PM Subject: Upcoming stable releases to fix a medium-severity security issue To: <tor-talk(a)lists.torproject.org> Hi! I'm planning to put out new Tor source releases some time Thursday or Friday. They will be versions 0.3.3.12, 0.3.4.11, 0.3.5.8, and 0.4.0.2-alpha. These versions will, among the usual array of bugfixes, fix a medium-severity security issue: a remote denial-of-service attack vector against relays and clients running version 0.3.2.1-alpha and later. While we don't currently know an exploit for the issue, we hope that all affected relays will upgrade. The issue is traced as TROVE-2019-001, Tor bug #29168, and CVE-2019-8955. One more reminder: the 0.3.3.x series was scheduled to reach end-of-life as of February 22. We've extended that to February 28, but after that date, there will be no more security updates for the 0.3.3.x series. If you need a version that will receive long-term support, we recommend that you stick with 0.3.5.x, which will be supported until 2022. best wishes, -- Nick

1 0