torproject/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-12-06 19:41:15 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fold in recent changes entries

Browse Source
This commit is contained in:
Roger Dingledine
2012-10-19 14:43:21 -04:00
parent 55cae7dbf1
commit 161ca100a6
4 changed files with 19 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog
+19 -2
View File
@@ -1,12 +1,25 @@
Changes in version 0.2.3.23-rc - 2012-10-14
Tor 0.2.3.23-rc adds a new v3 directory authority, and fixes a variety
Changes in version 0.2.3.23-rc - 2012-10-20
Tor 0.2.3.23-rc adds a new v3 directory authority, fixes a privacy
vulnerability introduced by a change in OpenSSL, and fixes a variety
of smaller bugs in preparation for the release.
o New directory authorities:
- Add Faravahar (run by Sina Rabbani) as the ninth v3 directory
authority. Closes ticket 5749.
o Major bugfixes (security):
- Disable TLS session tickets. OpenSSL's implementation was giving
our TLS session keys the lifetime of our TLS context objects, when
perfect forward secrecy would want us to discard anything that
could decrypt a link connection as soon as the link connection
was closed. Fixes bug 7139; bugfix on all versions of Tor linked
against OpenSSL 1.0.0 or later. Found by Florent Daignière.
o Major bugfixes:
- Discard extraneous renegotiation attempts once the V3 link
protocol has been initiated. Failure to do so left us open to
a remotely triggerable assertion failure. Fixes CVE-2012-2249;
bugfix on 0.2.3.6-alpha. Reported by "some guy from France".
- Fix a possible crash bug when checking for deactivated circuits
in connection_or_flush_from_first_active_circuit(). Fixes bug 6341;
bugfix on 0.2.2.7-alpha. Bug report and fix received pseudonymously.
@@ -22,6 +35,10 @@ Changes in version 0.2.3.23-rc - 2012-10-14
bias" detection. Fixes bug 7022; bugfix on 0.2.3.21-rc.
o Minor bugfixes (on 0.2.2.x and earlier):
- Don't serve or accept v2 hidden service descriptors over a relay's
DirPort. It's never correct to do so, and disabling it might
make it more annoying to exploit any bugs that turn up in the
descriptor-parsing code. Fixes bug 7149.
- When relays refuse a "create" cell because their queue of pending
create cells is too big (typically because their cpu can't keep up
with the arrival rate), send back reason "resource limit" rather
changes/bug7139
-9
View File
@@ -1,9 +0,0 @@
o Major bugfixes (security):
- Disable TLS session tickets. OpenSSL's implementation were giving
our TLS session keys the lifetime of our TLS context objects, when
perfect forward secrecy would want us to discard anything that
could decrypt a link connection as soon as the link connection was
closed. Fixes bug 7139; bugfix on all versions of Tor linked
against OpenSSL 1.0.0 or later. Found by "nextgens".
changes/cve-2012-2249
-5
View File
@@ -1,5 +0,0 @@
o Major bugfixes (security):
- Discard extraneous renegotiation attempts once the V3 link
protocol has been initiated. Failure to do so left us open to
a remotely triggerable assertion failure. Fixes CVE-2012-2249;
bugfix on 0.2.3.6-alpha. Reported by "some guy from France".
changes/dirserv-BUGGY-a
-7
View File
@@ -1,7 +0,0 @@
o Minor bugfixes:
- Don't serve or accept v2 hidden service descriptors over a
relay's DirPort. It's never correct to do so, and disabling it
might make it more annoying to exploit any bugs that turn up in the
descriptor-parsing code. Fixes bug 7149.