← Back to team overview

group.of.nepali.translators team mailing list archive

  1. group.of.nepali.translators team
  2. Mailing list archive
  3. Message #21772

[Bug 1731698] Re: [SRU] Tor 0.2.9.14 and 0.3.0.13

  Thread Previous • Date Previous • • Thread Next 
This bug was fixed in the package tor - 0.3.0.13-0ubuntu1~17.10.1

---------------
tor (0.3.0.13-0ubuntu1~17.10.1) artful; urgency=medium

  [ Peter Palfrader ]
  * Change "AppArmorProfile=system_tor" to AppArmorProfile=-system_tor,
    causing all errors while switching to the new apparmor profile to
    be ignored.  This is not ideal, but for now it's probably the
    best solution. Thanks to intrigeri; closes: #880490.

  [ Simon Deziel ]
  * New upstream version: 0.3.0.13 (LP: #1731698)
    - Fix a denial of service bug where an attacker could use a
      malformed directory object to cause a Tor instance to pause while
      OpenSSL would try to read a passphrase from the terminal. (Tor
      instances run without a terminal, which is the case for most Tor
      packages, are not impacted.) Fixes bug 24246; bugfix on every
      version of Tor. Also tracked as TROVE-2017-011 and CVE-2017-8821.
      Found by OSS-Fuzz as testcase 6360145429790720.
    - Fix a denial of service issue where an attacker could crash a
      directory authority using a malformed router descriptor. Fixes bug
      24245; bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2017-010
      and CVE-2017-8820.
    - When checking for replays in the INTRODUCE1 cell data for a
      (legacy) onion service, correctly detect replays in the RSA-
      encrypted part of the cell. We were previously checking for
      replays on the entire cell, but those can be circumvented due to
      the malleability of Tor's legacy hybrid encryption. This fix helps
      prevent a traffic confirmation attack. Fixes bug 24244; bugfix on
      0.2.4.1-alpha. This issue is also tracked as TROVE-2017-009
      and CVE-2017-8819.
    - Fix a use-after-free error that could crash v2 Tor onion services
      when they failed to open circuits while expiring introduction
      points. Fixes bug 24313; bugfix on 0.2.7.2-alpha. This issue is
      also tracked as TROVE-2017-013 and CVE-2017-8823.
    - When running as a relay, make sure that we never build a path
      through ourselves, even in the case where we have somehow lost the
      version of our descriptor appearing in the consensus. Fixes part
      of bug 21534; bugfix on 0.2.0.1-alpha. This issue is also tracked
      as TROVE-2017-012 and CVE-2017-8822.
    - When running as a relay, make sure that we never choose ourselves
      as a guard. Fixes part of bug 21534; bugfix on 0.3.0.1-alpha. This
      issue is also tracked as TROVE-2017-012 and CVE-2017-8822.
  * New upstream version: 0.3.0.12
    - Directory authority changes
  * New upstream version: 0.3.0.11
    - Fix TROVE-2017-008: Stack disclosure in hidden services logs when
      SafeLogging disabled (CVE-2017-0380)
  * debian/rules: stop overriding micro-revision.i

tor (0.3.0.10-2) UNRELEASED; urgency=medium

  * apparmor: use Pix instead of PUx for obfs4proxy, giving us
    better confinement of the child process while actually working
    with systemd's NoNewPrivileges.  (closes: #867342)
  * Drop versioned dependency on binutils.  The version is already
    newer in all supported Debian and Ubuntu trees, and binutils
    is in the transitive dependency set of build-essential.
    Patch by Helmut Grohne.  (closes: #873127)
  * Do not rely on aa-exec and aa-enabled being in /usr/sbin in the
    SysV init script.  This change enables apparmor confinement
    on some system-V systems again.  (closes: #869153)

 -- Simon Deziel <simon@xxxxxxxxxxxx>  Sun, 14 Jan 2018 14:15:21 -0500

** Changed in: tor (Ubuntu Artful)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1731698

Title:
  [SRU] Tor 0.2.9.14 and 0.3.0.13

Status in tor package in Ubuntu:
  Fix Released
Status in tor source package in Xenial:
  Fix Released
Status in tor source package in Artful:
  Fix Released

Bug description:
  Micro versions of Tor were recently released to address some security
  problems (CVE-2017-0380/TROVE-2017-008) and crashes. The new releases
  also include directory authority changes.

  [Test Case]

  1) Setup Tor:
  $ sudo apt-get install tor

  2) Check if the Tor network is usable:
  $ torsocks wget -qO - https://ifconfig.co
  192.0.2.1

  3) Check that the IP returned by https://ifconfig.co is NOT the one
     assigned by you ISP.

  4) If you got a different IP it means wget used the Tor network
  successfully

  5) Repeat with the -proposed package

  
  [Regression Potential]

  Unfortunately, I don't know what regression could be introduced by
  those micro version upgrades (0.2.9.11->0.2.9.13 and
  0.3.0.10->0.3.0.12). Debian shipped 0.2.9.12 some time ago and I
  didn't find any regression in their bug tracker. Unfortunately, Debian
  no longer ship the 0.3.0.x branch as they moved to 0.3.1.x so the
  version in Artful saw less "in the wild" testing.

  I also looked at the upstream bug tracker and didn't find any relevant
  regression introduced by those new versions.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/tor/+bug/1731698/+subscriptions
  Thread Previous • Date Previous • • Thread Next