tor/changes/ticket40286_minimal

  o Major bugfixes (security, denial of service):
    - Disable the dump_desc() function that we used to dump unparseable
      information to disk. It was called incorrectly in several places,
      in a way that could lead to excessive CPU usage.  Fixes bug 40286;
      bugfix on 0.2.2.1-alpha. This bug is also tracked as
      TROVE-2021-001 and CVE-2021-28089.
Clarify new intended strategy with TROVE-2021-001 We're going to disable this feature in all versions for now. 2021-03-15 08:53:36 -04:00			`o Major bugfixes (security, denial of service):`
Disable the dump_desc() function. It can be called with strings that should have been length-delimited, but which in fact are not. This can cause a CPU-DoS bug or, in a worse case, a crash. Since this function isn't essential, the best solution for older Tors is to just turn it off. Fixes bug 40286; bugfix on 0.2.2.1-alpha when dump_desc() was introduced. 2021-02-19 12:31:19 -05:00			`- Disable the dump_desc() function that we used to dump unparseable`
			`information to disk. It was called incorrectly in several places,`
Clarify new intended strategy with TROVE-2021-001 We're going to disable this feature in all versions for now. 2021-03-15 08:53:36 -04:00			`in a way that could lead to excessive CPU usage. Fixes bug 40286;`
			`bugfix on 0.2.2.1-alpha. This bug is also tracked as`
			`TROVE-2021-001 and CVE-2021-28089.`