- tor-packagers - lists.torproject.org

Tor 0.4.4.5 is released; 0.4.2.x has reached end-of-life
by Nick Mathewson 15 Sep '20

15 Sep '20

Hi! You can download Tor 0.4.4.5 from https://dist.torproject.org. Here are the changes since 0.4.3.6: https://gitweb.torproject.org/tor.git/tree/ReleaseNotes?h=tor-0.4.4.5 And here are the changes since 0.4.4.4-rc: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.4.5 Also, Tor 0.4.2.x has reached end-of-life, and is no longer supported. For a list of current supported series and their projected lifetimes, see https://gitlab.torproject.org/tpo/core/team/-/wikis/NetworkTeam/CoreTorRele… best wishes, -- Nick

1 0

Tor 0.4.4.4-rc is available
by Nick Mathewson 13 Aug '20

13 Aug '20

Hi, all! You can download 0.4.4.4-rc from https://dist.torproject.org/ . Be sure to check the signatures! Official announcements to follow. Changes in version 0.4.4.4-rc - 2020-08-13 Tor 0.4.4.4-rc is the first release candidate in its series. It fixes several bugs in previous versions, including some that caused annoying behavior for relay and bridge operators. o Minor features (security): - Channels using obsolete versions of the Tor link protocol are no longer allowed to circumvent address-canonicity checks. (This is only a minor issue, since such channels have no way to set ed25519 keys, and therefore should always be rejected for circuits that specify ed25519 identities.) Closes ticket 40081. o Minor features (defense in depth): - Wipe more data from connection address fields before returning them to the memory heap. Closes ticket 6198. o Minor bugfixes (correctness, buffers): - Fix a correctness bug that could cause an assertion failure if we ever tried using the buf_move_all() function with an empty input buffer. As far as we know, no released versions of Tor do this. Fixes bug 40076; bugfix on 0.3.3.1-alpha. o Minor bugfixes (linux seccomp2 sandbox): - Fix startup crash with seccomp sandbox enabled when tor tries to open the data directory. Patch from Daniel Pinto. Fixes bug 40072; bugfix on 0.4.4.3-alpha-dev. o Minor bugfixes (onion service v3): - Remove a BUG() warning that could trigger in certain unlikely edge-cases. Fixes bug 34086; bugfix on 0.3.2.1-alpha. o Minor bugfixes (rate limiting, bridges, pluggable transports): - On a bridge, treat all connections from an ExtORPort as remote by default for the purposes of rate-limiting. Previously, bridges would treat the connection as local unless they explicitly received a "USERADDR" command. ExtORPort connections still count as local if there is a USERADDR command with an explicit local address. Fixes bug 33747; bugfix on 0.2.5.1-alpha. o Minor bugfixes (relay, self-testing): - When starting up as a relay, if we haven't been able to verify that we're reachable, only launch reachability tests at most once a minute. Previously, we had been launching tests up to once a second, which was needlessly noisy. Fixes bug 40083; bugfix on 0.2.8.1-alpha. o Minor bugfixes (testing): - When running the subsystem order check, use the Python binary configured with the PYTHON environment variable. Fixes bug 40095; bugfix on 0.4.4.1-alpha. o Minor bugfixes (windows): - Fix a bug that prevented Tor from starting if its log file grew above 2GB. Fixes bug 31036; bugfix on 0.2.1.8-alpha.

1 0

Tor 0.4.4.3-alpha is available for download
by Nick Mathewson 27 Jul '20

27 Jul '20

Hi! You can download tor-0.4.4.3-alpha at https://dist.torproject.org. The changelog is at https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.4.3-alpha No major changes in this release; just some bugfixes and preparation for the release candidate, which I hope will come out in mid-august. Official announcements to follow after the website is updated. cheers, -- Nick

1 0

Package wiki discontinuation
by Damian Johnson 18 Jul '20

18 Jul '20

Hi all. Just a quick friendly head's up that now that Trac is read-only the packages wiki I've maintained these last three years will be discontinued... https://trac.torproject.org/projects/tor/wiki/doc/packages I suspect hardly anyone used it, but if anyone would care to create a GitLab replacement the script to keep such a page up to date is located at... https://gitweb.torproject.org/doctor.git/tree/package_versions.py Cheers! -Damian

1 0

New releases: 0.3.5.11, 0.4.2.8, 0.4.3.6, and 0.4.4.2-alpha
by Nick Mathewson 09 Jul '20

09 Jul '20

Hello! There are new tor releases in all supported series today. You can download them from https://dist.torproject.org/. Please remember to check the signatures! These releases fix a bunch of issues, including a remote denial of service attack that we are tracking as TROVE-2020-001 (and also as CVE-2020-15572). This DoS attack affects Tor relays and clients that have been compiled to use the NSS library. If you're using OpenSSL (the default) then it doesn't affect you. You can read the changelogs for the individual releases here: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.5.11 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.2.8 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.6 https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.4.2-alpha yrs, -- Nick

1 0

Upcoming releases this week, all series, with security fix
by Nick Mathewson 06 Jul '20

06 Jul '20

Hello! There will be a series of Tor releases later this week -- I'm aiming for Thursday or Friday. They will fix a security issue that we are ranking at "Medium" per our security policy at [1]. The issue is a denial-of-service attack that affects a comparatively uncommon configuration. We are tracking the security issue as TROVE-2020-001. We have requested a CVE, and will include it when we release on Friday. [1] https://gitlab.torproject.org/legacy/trac/-/wikis/org/teams/NetworkTeam/Sec… -- Nick

1 0

Tor 0.4.4.1-alpha is available
by Nick Mathewson 16 Jun '20

16 Jun '20

Hi, all! There is a stable release for 0.4.3.5. You can download it from the usual place at https://dist.torproject.org/ . Official announcements will come soon. Here's the changelog: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.4.1-alpha

1 1

Tor 0.4.3.5 is available
by Nick Mathewson 15 May '20

15 May '20

Hi, all! There is a stable release for 0.4.3.5. You can download it from the usual place at https://dist.torproject.org/ . Official announcements will come after the website has updated. Changes since 0.4.3.4-rc: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.5 Changes since 0.4.2.6: https://gitweb.torproject.org/tor.git/tree/ReleaseNotes?h=tor-0.4.3.5

1 0

Tor 0.4.3.4-rc is released!
by Nick Mathewson 13 Apr '20

13 Apr '20

Hi! There's a new release candidate available at https://dist.torproject.org/ . You can read the changelog at https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.4-rc This is a release candidate: unless people find serious bugs in it, there probably won't be any changes until the official release comes out in a couple of weeks. You can help by making sure that it gets into the hands of people who will test it. I'll send out official announcements once the website updates. best wishes, -- Nick

1 0

New Tor releases: 0.3.5.10, 0.4.1.9, 0.4.2.7, and 0.4.3.3-alpha
by Nick Mathewson 18 Mar '20

18 Mar '20

Hello! New tor releases are tagged and signed, and available at https://dist.torproject.org/ . Please remember to check the signatures. Here are the changelog links: 0.3.5.10: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.3.5.10 0.4.1.9: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.1.9 0.4.2.7: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.2.7 0.4.3.3-alpha: https://gitweb.torproject.org/tor.git/tree/ChangeLog?h=tor-0.4.3.3-alpha Note that these releases fix several vulnerabilities, including a remotely triggerable CPU DoS. Everybody running older versions should upgrade to one of these. For TROVE and CVE identifiers and more about the vulnerabilities, please see the ChangeLogs. I'll send official announcements after the website has updated.

1 0