http://lmgtfy.com/?q=CVE-2017-0380

-------- Original Message -------- Subject: Re: [tor-relays] More recent rpm somewhere? Local Time: September 17, 2017 12:53 PM UTC Time: September 17, 2017 12:53 PM From: bnagaev@gmail.com To: tor-relays@lists.torproject.org

On Sun, Sep 17, 2017 at 8:22 AM, nusenu nusenu-lists@riseup.net wrote:

...

...

I"m running a few relays on CentOS 7 As I"m sticking to the ease of rpm distributions, I"m left behind on 0.2.9.10 from EPEL

Does anyone know of another rpm repository with a more up to date version ?

I"m not aware of any updated (trustworthy) RPM repository. Also the promising comment on the bugtracker didn"t lead to an updated package https://bugzilla.redhat.com/show_bug.cgi?id=1284469#c48

The upcoming tor releases fixing CVE-2017-0380 will make it even more uncomfortable for RPM users if there will be no updated packages for them and it does not look like there is anyone working on it.

Can you provide a reference to CVE-2017-0380, please?

...

so the options are not to promising:

• build your own tor packages
• run your relay with another OS that has a maintained tor package

-- https://mastodon.social/@nusenu https://twitter.com/nusenu_

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

-- Best regards, Boris Nagaev _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

On 17 Sep 2017, at 22:53, Nagaev Boris bnagaev@gmail.com wrote:

On Sun, Sep 17, 2017 at 8:22 AM, nusenu nusenu-lists@riseup.net wrote:

...

...

I'm running a few relays on CentOS 7 As I'm sticking to the ease of rpm distributions, I'm left behind on 0.2.9.10 from EPEL

Does anyone know of another rpm repository with a more up to date version ?

I'm not aware of any updated (trustworthy) RPM repository. Also the promising comment on the bugtracker didn't lead to an updated package https://bugzilla.redhat.com/show_bug.cgi?id=1284469#c48

The upcoming tor releases fixing CVE-2017-0380 will make it even more uncomfortable for RPM users if there will be no updated packages for them and it does not look like there is anyone working on it.

Can you provide a reference to CVE-2017-0380, please?

This issue does not affect relays, only hidden services with SafeLogging turned off (the default is on).

https://trac.torproject.org/projects/tor/ticket/23490 https://lists.torproject.org/pipermail/tor-announce/2017-September/000139.ht...

T

-- Tim Wilson-Brown (teor)

teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------

Yihaa !!!

Thanks a lot for the pointer I have loaded 0.2.9.12 on a VM and I'm waiting until it appears on Atlas before rolling it out to my "prod" relays

2017-10-06 23:12 GMT+02:00 nusenu nusenu-lists@riseup.net:

Patrick DERWAEL:

...

Hi folks,

I'm running a few relays on CentOS 7 As I'm sticking to the ease of rpm distributions, I'm left behind on 0.2.9.10 from EPEL

Does anyone know of another rpm repository with a more up to date

version ?

maha updated the RPM packages and they are currently in testing repos.

https://bodhi.fedoraproject.org/updates/?packages=tor

-- https://mastodon.social/@nusenu twitter: @nusenu_

---

tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays