Path to this page:
Subject: CVS commit: pkgsrc/net/tor
From: Thomas Klausner
Date: 2018-03-04 08:46:06
Message id: 20180304074606.7468AFB40@cvs.NetBSD.org
Log Message:
tor: update to 0.3.2.10.
Changes in version 0.3.2.10 - 2018-03-03
Tor 0.3.2.10 is the second stable release in the 0.3.2 series. It
backports a number of bugfixes, including important fixes for security
issues.
It includes an important security fix for a remote crash attack
against directory authorities, tracked as TROVE-2018-001.
Additionally, it backports a fix for a bug whose severity we have
upgraded: Bug 24700, which was fixed in 0.3.3.2-alpha, can be remotely
triggered in order to crash relays with a use-after-free pattern. As
such, we are now tracking that bug as TROVE-2018-002 and
CVE-2018-0491, and backporting it to earlier releases. This bug
affected versions 0.3.2.1-alpha through 0.3.2.9, as well as version
0.3.3.1-alpha.
This release also backports our new system for improved resistance to
denial-of-service attacks against relays.
This release also fixes several minor bugs and annoyances from
earlier releases.
Relays running 0.3.2.x SHOULD upgrade to one of the versions released
today, for the fix to TROVE-2018-002. Directory authorities should
also upgrade. (Relays on earlier versions might want to update too for
the DoS mitigations.)
Files: