Skip to main content
Home

The Tor Project

Enter the terms you wish to search for.

Main menu

  • About Tor
  • Donate

Why Tor is slow and what we're going to do about it

by arma | March 13, 2009

I've just finished writing up an explanation of all the various reasons why the Tor network is slow, and what we can do about each.

  • 38 comments

Our three-year development roadmap is published

by phobos | December 19, 2008

We've published our three-year development roadmap.

  • 12 comments

Upcoming Events

March 28, 2019
Tor Meetup (Valencia)
March 23, 2019 - March 24, 2019
LibrePlanet (Boston)
March 24, 2019 - March 27, 2019
KNOW 2019 (Vegas)
April 01, 2019 - April 05, 2019
Internet Freedom Festival (Valencia)
June 11, 2019 - June 14, 2019
RightsCon (Tunis)
See All Upcoming Events

Recent Updates

Making Diversity The Default in The Open Source World

by gaba | March 08, 2019

Tor is a community, an organization, a network, and a place to build and maintain technology that protects your information when navigating the internet.

International Women's Day

by isabela | March 07, 2019

Today, March 8th, women all around the world are expressing themselves in one way or another on commemorating their all year long struggle for equality and justice.

How Has Tor Helped You? Send Us Your Story.

by steph | February 25, 2019

Last September, we asked to hear stories about how Tor has helped protect people online.

New Releases: Tor 0.4.0.2-alpha, 0.3.5.8, 0.3.4.11, and 0.3.3.12

by nickm | February 21, 2019

There are new source code releases available for download. If you build Tor from source, you can download the source code for 0.4.0.2-alpha and 0.3.5.8 from the download page. You can find 0.3.4.11 and 0.3.3.12 at dist.torproject.org. Packages should be available over the coming weeks, with a new alpha Tor Browser release likely in the same timeframe.

These releases all fix TROVE-2019-001, a possible security bug involving the KIST cell scheduler code in versions 0.3.2.1-alpha and later. We are not certain that it is possible to exploit this bug in the wild, but out of an abundance of caution, we recommend that all affected users upgrade once packages are available. The potential impact is a remote denial-of-service attack against clients or relays.

Also note: 0.3.3.12 is the last anticipated release in the 0.3.3.x series; that series will become unsupported next week. The remaining supported stable series will 0.2.9.x (long-term support until 2020), 0.3.4.x (supported until June), and 0.3.5.x (long-term support until 2022).

Below are the changes in Tor 0.3.5.8 and in 0.4.0.2-alpha. You can also read the changelog for 0.3.4.11 and the changelog for 0.3.3.12.

Changes in version 0.3.5.8 - 2019-02-21

Tor 0.3.5.8 backports serveral fixes from later releases, including fixes for an annoying SOCKS-parsing bug that affected users in earlier 0.3.5.x releases.

It also includes a fix for a medium-severity security bug affecting Tor 0.3.2.1-alpha and later. All Tor instances running an affected release should upgrade to 0.3.3.12, 0.3.4.11, 0.3.5.8, or 0.4.0.2-alpha.

  • Major bugfixes (cell scheduler, KIST, security):
    • Make KIST consider the outbuf length when computing what it can put in the outbuf. Previously, KIST acted as though the outbuf were empty, which could lead to the outbuf becoming too full. It is possible that an attacker could exploit this bug to cause a Tor client or relay to run out of memory and crash. Fixes bug 29168; bugfix on 0.3.2.1-alpha. This issue is also being tracked as TROVE-2019-001 and CVE-2019-8955.
  • Major bugfixes (networking, backport from 0.4.0.2-alpha):
    • Gracefully handle empty username/password fields in SOCKS5 username/password auth messsage and allow SOCKS5 handshake to continue. Previously, we had rejected these handshakes, breaking certain applications. Fixes bug 29175; bugfix on 0.3.5.1-alpha.

 

© 2019 The Tor Project

Footer

  • The Tor Project
  • RSS
  • Donate