Skip to main content
Home

The Tor Project

Enter the terms you wish to search for.

Main menu

  • About Tor
  • Donate

New releases (with security fixes): Tor 0.3.5.14, 0.4.4.8, and 0.4.5.7

by nickm | March 16, 2021

We have a new stable release today. If you build Tor from source, you can download the source code for 0.4.5.7 on the download page. Packages should be available within the next several weeks, with a new Tor Browser coming next week.

Also today, Tor 0.3.5.14 (changelog) and Tor 0.4.4.8 (changelog) have also been released; you can find them (and source for older Tor releases) at https://dist.torproject.org.

These releases fix a pair of denial-of-service issues, described below. One of these issues is authority-only.  The other issue affects all Tor instances, and is most damaging on directory authorities and relays.  We recommend that everybody should upgrade to one of these versions once packages are available.

Tor 0.4.5.7 fixes two important denial-of-service bugs in earlier versions of Tor.

One of these vulnerabilities (TROVE-2021-001) would allow an attacker who can send directory data to a Tor instance to force that Tor instance to consume huge amounts of CPU. This is easiest to exploit against authorities, since anybody can upload to them, but directory caches could also exploit this vulnerability against relays or clients when they download. The other vulnerability (TROVE-2021-002) only affects directory authorities, and would allow an attacker to remotely crash the authority with an assertion failure. Patches have already been provided to the authority operators, to help ensure network stability.

We recommend that everybody upgrade to one of the releases that fixes these issues (0.3.5.14, 0.4.4.8, or 0.4.5.7) as they become available to you.

This release also updates our GeoIP data source, and fixes a few smaller bugs in earlier releases.

Changes in version 0.4.5.7 - 2021-03-16

  • Major bugfixes (security, denial of service):
    • Disable the dump_desc() function that we used to dump unparseable information to disk. It was called incorrectly in several places, in a way that could lead to excessive CPU usage. Fixes bug 40286; bugfix on 0.2.2.1-alpha. This bug is also tracked as TROVE-2021- 001 and CVE-2021-28089.
    • Fix a bug in appending detached signatures to a pending consensus document that could be used to crash a directory authority. Fixes bug 40316; bugfix on 0.2.2.6-alpha. Tracked as TROVE-2021-002 and CVE-2021-28090.
  • Minor features (geoip data):
    • We have switched geoip data sources. Previously we shipped IP-to- country mappings from Maxmind's GeoLite2, but in 2019 they changed their licensing terms, so we were unable to update them after that point. We now ship geoip files based on the IPFire Location Database instead. (See https://location.ipfire.org/ for more information). This release updates our geoip files to match the IPFire Location Database as retrieved on 2021/03/12. Closes ticket 40224.

 

  • 3 comments
  • Join the discussion...

How to contribute to the Tor metrics timeline

by dcf | March 12, 2021

The metrics timeline is a database of news and events that may affect Tor Metrics graphs. This post is about how you can contribute to the timeline and help keep it up to date.

  • 6 comments

New Release: Tor Browser 10.0.13 (Linux Only)

by sysrqb | March 03, 2021

Tor Browser 10.0.13 is now available from the Tor Browser download page and also from our distribution directory.

  • 40 comments

New Release: OnionShare 2.3

by micah | February 25, 2021

OnionShare 2.3 adds tabs, anonymous chat, better command line support, and quite a bit more.

Learning more about our users

by duncan | February 24, 2021

We invite you to give your feedback in a new user survey.

New Release: Tor Browser 10.5a11

by gk | February 24, 2021

Tor Browser 10.5a11 is now available from the Tor Browser Alpha download page and also from our distribution directory.

  • 13 comments

New Release: Tor Browser 10.0.12

by sysrqb | February 23, 2021

Tor Browser 10.0.12 is now available from the Tor Browser download page and also from our distribution directory.

  • 49 comments

New Release: Tor 0.4.5.6

by nickm | February 15, 2021

After months of work, we have a new stable release series! If you build Tor from source, you can download the source code for 0.4.5.6 on the download page. Packages should be available within the next several weeks, with a new Tor Browser likely next week.

The Tor 0.4.5.x release series is dedicated to the memory of Karsten Loesing (1979-2020), Tor developer, cypherpunk, husband, and father. Karsten is best known for creating the Tor metrics portal and leading the metrics team, but he was involved in Tor from the early days. For example, while he was still a student he invented and implemented the v2 onion service directory design, and he also served as an ambassador to the many German researchers working in the anonymity field. We loved him and respected him for his patience, his consistency, and his welcoming approach to growing our community.

This release series introduces significant improvements in relay IPv6 address discovery, a new "MetricsPort" mechanism for relay operators to measure performance, LTTng support, build system improvements to help when using Tor as a static library, and significant bugfixes related to Windows relay performance. It also includes numerous smaller features and bugfixes.

Below are the changes since 0.4.4.7. For a list of changes since 0.4.5.5-rc, see the ChangeLog file.

Changes in version 0.4.5.6 - 2021-02-15

  • Major features (build):
    • When building Tor, first link all object files into a single static library. This may help with embedding Tor in other programs. Note that most Tor functions do not constitute a part of a stable or supported API: only those functions in tor_api.h should be used if embedding Tor. Closes ticket 40127.
  • Major features (metrics):
    • Introduce a new MetricsPort which exposes, through an HTTP interface, a series of metrics that tor collects at runtime. At the moment, the only supported output format is Prometheus data model. Closes ticket 40063. See the manual page for more information and security considerations.

 

  • 5 comments
  • Join the discussion...

Bug Smash Fund, Year 2: Progress So Far!

by alsmith | February 12, 2021

Last August, we asked you to help us fundraise during our second annual Bug Smash Fund campaign. We want to share an update on some of the work that the second year of the Bug Smash Fund has made possible.

  • 12 comments

Anonymous GitLab Ticketing: An Exciting New Project at Tor

by MariaV | February 09, 2021

Hi! My name is Maria Violante, and I’m one of two Outreachy interns for Tor Project for Winter 2020/2021.

Pagination

  • First page « First
  • Previous page ‹ Previous
  • Page 1
  • Current page 2
  • Page 3
  • Page 4
  • …
  • Next page Next ›
  • Last page Last »

Upcoming Events

There are currently no upcoming events scheduled.

See All Upcoming Events

Recent Updates

New Alpha Release: Tor 0.4.6.2-alpha

by nickm | April 15, 2021

There's a new alpha release available for download. If you build Tor from source, you can download the source code for 0.4.6.2-alpha from the download page on the website. Packages should be available over the coming weeks, with a new alpha Tor Browser release likely some time next week.

Remember, this is an alpha release: you should only run this if you'd like to find and report more bugs than usual.

Tor 0.4.6.2-alpha is the second alpha in its series. It fixes several small bugs in previous releases, and solves other issues that had enabled denial-of-service attacks and affected integration with other tools.

Changes in version 0.4.6.2-alpha - 2021-04-15

  • Minor features (client):
    • Clients now check whether their streams are attempting to re-enter the Tor network (i.e. to send Tor traffic over Tor), and close them preemptively if they think exit relays will refuse them for this reason. See ticket 2667 for details. Closes ticket 40271.
  • Minor features (command line):
    • Add long format name "--torrc-file" equivalent to the existing command-line option "-f". Closes ticket 40324. Patch by Daniel Pinto.

 

New Release: Tor Browser 10.5a14

by sysrqb | April 13, 2021

Tor Browser 10.5a14 is now available from the Tor Browser Alpha download page and also from our

New Release: Tor Browser 10.5a13

by sysrqb | April 05, 2021

Tor Browser 10.5a13 is now available from the Tor Browser Alpha download page and also from our

New Release: Tor Browser 10.0.15

by sysrqb | March 27, 2021

Update: 9 April 2021: Android Tor Browser 10.0.15 is now available.

© 2021 The Tor Project

Footer

  • The Tor Project
  • RSS
  • Donate