Tor Project Status – “Experiencing Network DDoS of v3 Onion Services”
status.torproject.org
status.torproject.org
We have released tor 0.4.7.8 earlier today, a new stable version for the 0.4.7.x series containing an important High severity security fix.
The affected tor are only those of the 0.4.7.x series as in from tor-0.4.7.1-alpha to tor-0.4.7.7.
https://forum.torproject.net/t/stable-release-0-4-7-8/3679
As stated in the announcement (link above), we strongly recommend that everyone upgrades to 0.4.7.8.
Packages are being updated and released for OS distributions so keep an eye out!
Our beloved packagers are hard at work!
Also, I will repeat it here, the security issue is categorized as a Denial of Service,
so it is not affecting the security of the host machine running "tor".
Nevertheless, again, we strongly encourage you to upgrade.
Here is the ChangeLog for this version:
Changes in version 0.4.7.8 - 2022-06-17
This version fixes several bugfixes including a High severity security issue categorized as a Denial of Service.
o Major bugfixes (congestion control, TROVE-2022-001):
seriously degrading congestion control performance on all circuits.
This impacts clients, onion services, and relays, and can be triggered remotely by a malicious endpoint.
Tracked as CVE-2022-33903. Fixes bug 40626; bugfix on 0.4.7.5-alpha.
o Minor features (fallbackdir):
o Minor features (geoip data):
o Minor bugfixes (linux seccomp2 sandbox):
This solves a crash issue with glibc 2.35 on Linux. Patch from pmu-ipf. Fixes bug 40601; bugfix on 0.3.5.11.
o Minor bugfixes (logging):
about finding a second hop to from warn level to info level, if we do not have enough descriptors yet.
Leave it at notice level for other cases. Fixes bug 40603; bugfix on 0.4.7.1-alpha.
Demote a notice log message about "Unexpected path length" to info level.
These cases seem to happen arbitrarily, and we likely will never find all of them before the switch to arti.
Fixes bug 40612; bugfix on 0.4.7.5-alpha.
o Minor bugfixes (relay, logging):
Cheers! David