[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-talk] Tor 0.2.3.24-rc is out



Tor 0.2.3.24-rc fixes two important security vulnerabilities that
could lead to remotely triggerable relay crashes, and fixes
a major bug that was preventing clients from choosing suitable exit
nodes.

I hope this will be the final release candidate for the 0.2.3 series.
That is, if we don't find any urgent issues, the next release will be
called stable.

https://www.torproject.org/download/download
https://www.torproject.org/dist/

(Packages coming eventually, hopefully soon since this is the final
release candidate.)

Changes in version 0.2.3.24-rc - 2012-10-25
  o Major bugfixes (security):
    - Fix a group of remotely triggerable assertion failures related to
      incorrect link protocol negotiation. Found, diagnosed, and fixed
      by "some guy from France". Fix for CVE-2012-2250; bugfix on
      0.2.3.6-alpha.
    - Fix a denial of service attack by which any directory authority
      could crash all the others, or by which a single v2 directory
      authority could crash everybody downloading v2 directory
      information. Fixes bug 7191; bugfix on 0.2.0.10-alpha.

  o Major bugfixes:
    - When parsing exit policy summaries from microdescriptors, we had
      previously been ignoring the last character in each one, so that
      "accept 80,443,8080" would be treated by clients as indicating
      a node that allows access to ports 80, 443, and 808. That would
      lead to clients attempting connections that could never work,
      and ignoring exit nodes that would support their connections. Now
      clients parse these exit policy summaries correctly. Fixes bug 7192;
      bugfix on 0.2.3.1-alpha.

  o Minor bugfixes:
    - Clients now consider the ClientRejectInternalAddresses config option
      when using a microdescriptor consensus stanza to decide whether
      an exit relay would allow exiting to an internal address. Fixes
      bug 7190; bugfix on 0.2.3.1-alpha.

Attachment: signature.asc
Description: Digital signature

_______________________________________________
tor-talk mailing list
tor-talk@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk