sarah
/
tor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

copy changelog to releasenotes

This commit is contained in:
Nick Mathewson 2017-12-01 09:14:18 -05:00
parent b97fb313a9
commit 7d83cfb3ab
1 changed files with 45 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
ReleaseNotes
View File

@ -2,6 +2,51 @@ This document summarizes new features and bugfixes in each stable release
of Tor. If you want to see more detailed descriptions of the changes in
each development snapshot, see the ChangeLog file.
Changes in version 0.2.5.16 - 2017-12-01
Tor 0.2.5.13 backports important security and stability bugfixes from
later Tor releases. All Tor users should upgrade to this release, or
to another of the releases coming out today.
Note: the Tor 0.2.5 series will no longer be supported after 1 May
2018. If you need a release with long-term support, please upgrade to
the 0.2.9 series. Otherwise, please upgrade to 0.3.1 or later.
o Major bugfixes (security, backport from 0.3.2.6-alpha):
- Fix a denial of service bug where an attacker could use a
malformed directory object to cause a Tor instance to pause while
OpenSSL would try to read a passphrase from the terminal. (Tor
instances run without a terminal, which is the case for most Tor
packages, are not impacted.) Fixes bug 24246; bugfix on every
version of Tor. Also tracked as TROVE-2017-011 and CVE-2017-8821.
Found by OSS-Fuzz as testcase 6360145429790720.
- When checking for replays in the INTRODUCE1 cell data for a
(legacy) onion service, correctly detect replays in the RSA-
encrypted part of the cell. We were previously checking for
replays on the entire cell, but those can be circumvented due to
the malleability of Tor's legacy hybrid encryption. This fix helps
prevent a traffic confirmation attack. Fixes bug 24244; bugfix on
0.2.4.1-alpha. This issue is also tracked as TROVE-2017-009
and CVE-2017-8819.
o Major bugfixes (security, relay, backport from 0.3.2.6-alpha):
- When running as a relay, make sure that we never build a path
through ourselves, even in the case where we have somehow lost the
version of our descriptor appearing in the consensus. Fixes part
of bug 21534; bugfix on 0.2.0.1-alpha. This issue is also tracked
as TROVE-2017-012 and CVE-2017-8822.
o Minor features (bridge, backport from 0.3.1.9):
- Bridges now include notice in their descriptors that they are
bridges, and notice of their distribution status, based on their
publication settings. Implements ticket 18329. For more fine-
grained control of how a bridge is distributed, upgrade to 0.3.2.x
or later.
o Minor features (geoip):
- Update geoip and geoip6 to the November 6 2017 Maxmind GeoLite2
Country database.
Changes in version 0.2.5.15 - 2017-10-25
Tor 0.2.5.15 backports a collection of bugfixes from later Tor release
series. It also adds a new directory authority, Bastet.