A Tor toolkit corrective update (0.3.5.11, 0.4.2.8, 0.4.3.6 and 4.4.2-alpha) used to organize the operation of the anonymous Tor network. The new versions have eliminated (CVE-2020-15572), which was caused by accessing memory outside the bounds of the allocated buffer. The vulnerability allows a remote attacker to crash the tor process. This issue appears only when compiled with the NSS library (by default, Tor is compiled with OpenSSL, and using NSS requires specifying the "—enable-nss" flag).
További információ the plan to discontinue support for the second version of the onion services protocol (formerly known as hidden services). One and a half years ago, in release 0.3.2.9, users were introduced to the third version of the protocol for onion services, notable for the transition to 56-character addresses, improved protection against data leaks through directory servers, a modular extensible structure, and the use of algorithms such as SHA3, ed25519, and curve25519 instead of SHA1, DH, and RSA-1024.
The second version of the protocol was developed about 15 years ago and cannot be considered secure in modern conditions due to the use of outdated algorithms. Given the end of support for old branches, currently any up-to-date Tor gateway supports the third version of the protocol, which is default when creating new onion services.
On September 15, 2020, Tor will start issuing warnings to operators and clients about the obsolescence of the second version of the protocol. On July 15, 2021, support for the second version of the protocol will be removed from the codebase, and on October 15, 2021, a new stable release of Tor will come out without support for the old protocol. Therefore, owners of old onion services have 16 months to transition to the new version of the protocol, which requires generating a new 56-character address for the service.
Forrás: opennet.ru
