[tor-relays] TROVE-2017-002: deb.torproject.org 0.3.0.x repos updated

[nusenu]

I expected that question.

>> tor 0.3.0.7 reached the deb.tpo repos
> 
> Just to make sure I don't misunderstand: As of today, should using
> 
>   deb http://deb.torproject.org/torproject.org jessie main
>   deb-src http://deb.torproject.org/torproject.org jessie main
> 
> result in Tor 0.3.0.7 being used? 

No, only if you choose the 0.3.0.x repos on deb.torproject.org

The 0.3.0.x repos got updated to 0.3.0.7 (from 0.3.0.5-rc).
That was the important part in the context of TROVE-2017-002 since tor
prior to 0.3.0.1-alpha is not vulnerable.

If you want 0.3.0.7 regardless, you will have to adjust the sources.list
file, as Roger suggested, the stable repos will probably stay at 0.2.9.x
and that is fine (LTS release).


-- 
https://mastodon.social/@nusenu
https://twitter.com/nusenu_

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20170521/67bf3d8f/attachment.sig>