Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump to tor 0.4.8.12 #148

Open
bitmold opened this issue Jun 26, 2024 · 4 comments
Open

Bump to tor 0.4.8.12 #148

bitmold opened this issue Jun 26, 2024 · 4 comments
Assignees

Comments

@bitmold
Copy link
Contributor

bitmold commented Jun 26, 2024

https://forum.torproject.org/t/stable-release-0-4-8-12/13060
https://gitlab.torproject.org/tpo/core/tor/-/tags/tor-0.4.8.12

Changes in version 0.4.8.12 - 2024-06-06
This is a minor release with couple bugfixes affecting conflux and logging.
We also have the return of faravahar directory authority with new keys and
address.

o Minor feature (dirauth):
- Add back faravahar with a new address and new keys. Closes 40689.

o Minor features (fallbackdir):
- Regenerate fallback directories generated on June 06, 2024.

o Minor features (geoip data):
- Update the geoip files to match the IPFire Location Database, as
retrieved on 2024/06/06.

o Minor bugfix (circuit):
- Remove a log_warn being triggered by a protocol violation that
already emits a protocol warning log. Fixes bug 40932; bugfix
on 0.4.8.1-alpha.

o Minor bugfixes (conflux):
- Avoid a potential hard assert (crash) when sending a cell on a
Conflux set. Fixes bug 40921; bugfix on 0.4.8.1-alpha.
- Make sure we don't process a closed circuit when packaging data.
This lead to a non fatal BUG() spamming logs. Fixes bug 40908;
bugfix on 0.4.8.1-alpha.

@bitmold
Copy link
Contributor Author

bitmold commented Jun 26, 2024

@uniqx could you please rebase the tor fork and then I prep tor-android for a new release.

@bitmold
Copy link
Contributor Author

bitmold commented Jun 26, 2024

I just upgraded us to the new openssl-3.0.14 which is addresses a few CVEs and is what the newest Tor Browser is using alongside tor v0.4.8.12:

Fixed potential use after free after SSL_free_buffers() is called ([CVE-2024-4741])
Fixed an issue where checking excessively long DSA keys or parameters may be very slow ([CVE-2024-4603])
Fixed unbounded memory growth with session handling in TLSv1.3 ([CVE-2024-2511])

@bitmold
Copy link
Contributor Author

bitmold commented Jul 14, 2024

@uniqx @n8fr8 is there a way we can release a tor for 0.4.8.12 soon

@uniqx
Copy link
Member

uniqx commented Jul 15, 2024

I've rebased our Android specific changes on tor 0.4.8.12: guardianproject/tor#10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants