New releases: Tor 0.3.5.13, 0.4.3.8, and 0.4.4.7

by nickm | February 03, 2021

We have a new stable release today. If you build Tor from source, you can download the source code for 0.4.4.7 on the download page. Packages should be available within the next several weeks, with a new Tor Browser later this month.

We're also releasing updates for older stable release series. You can download 0.3.5.13 (changelog) and 0.4.3.8 (changelog) from dist.torproject.org. Note that the 0.4.3.x series will no longer be supported after 15 February.

Tor 0.4.4.7 backports numerous bugfixes from later releases, including one that made v3 onion services more susceptible to denial-of-service attacks, and a feature that makes some kinds of DoS attacks harder to perform.

Changes in version 0.4.4.7 - 2021-02-03

  • Major bugfixes (onion service v3, backport from 0.4.5.3-rc):
    • Stop requiring a live consensus for v3 clients and services, and allow a "reasonably live" consensus instead. This allows v3 onion services to work even if the authorities fail to generate a consensus for more than 2 hours in a row. Fixes bug 40237; bugfix on 0.3.5.1-alpha.
  • Major feature (exit, backport from 0.4.5.5-rc):
    • Re-entry into the network is now denied at the Exit level to all relays' ORPorts and authorities' ORPorts and DirPorts. This change should help mitgate a set of denial-of-service attacks. Closes ticket 2667.

 

2020 Fundraising Results: Thank You!

Thank you to everyone who made a donation in 2020! You make it possible to resist the surveillance pandemic. You’ve made it possible for the Tor Project and the tools we support to survive a very difficult time, and to prepare for 2021 with ambitious plans.