diff options
| -rw-r--r-- | CHANGELOG.md | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index e7649fb9b..873d136f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,8 +9,8 @@ Arti 2.5.0 comes with lots of progress in the relay and directory authority space, including ntor handshake handling, as well as encoding/decoding support for router- and micro descriptors. -This release also includes a number of important bug fixes, as well as a security -fix for a medium-severity security issue, [TROVE-2026-24]. +This release also includes a number of important bug fixes, as well as two security +fixes for medium-severity security issues, [TROVE-2026-24] and [TROVE-2026-27]. As usual, there are also many small changes and improvements which are detailed below. @@ -28,6 +28,11 @@ As usual, there are also many small changes and improvements which are detailed ([#2566], [!4062]) - Disabled and removed various uses of string slices as the aftermath of [TROVE-2026-24]. ([#2571], [!4062], [!4068], [!4103], [!4092], [!4142], [!4143]) +- Fixed the medium-severity DoS security vulnerability ([TROVE-2026-27]), which + could lead to an attacker exploiting an inefficient algorithm, resulting in + the stalling of the CPU. + We have not observed this being abused in the wild. + ([#2601]) ### Major features @@ -313,8 +318,10 @@ for funding the development of Arti! [#2571]: https://gitlab.torproject.org/tpo/core/arti/-/issues/2571 [#2587]: https://gitlab.torproject.org/tpo/core/arti/-/issues/2587 [#2590]: https://gitlab.torproject.org/tpo/core/arti/-/issues/2590 +[#2601]: https://gitlab.torproject.org/tpo/core/arti/-/work_items/2601 [Bureau of Democracy, Human Rights, and Labor]: https://www.state.gov/bureaus-offices/under-secretary-for-civilian-security-democracy-and-human-rights/bureau-of-democracy-human-rights-and-labor/ [TROVE-2026-24]: https://gitlab.torproject.org/tpo/core/arti/-/work_items/2566 +[TROVE-2026-27]: https://gitlab.torproject.org/tpo/core/arti/-/work_items/2601 [other sponsors]: https://www.torproject.org/about/sponsors/ |