Draft changelog for 0.3.3.3-alpha

1 files changed, 33 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 76a001a815..1b7d293191 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,28 @@
 Changes in version 0.3.3.3-alpha - 2018-03-??
   Tor 0.3.3.3-alpha is the third alpha release for the 0.3.3.x series.
+  It includes an important security fix for a remote crash attack
+  against directory authorities tracked as TROVE-2018-001.
 
-  (TROVE BLURB HERE.)
+  Additionally, with this release, we are upgrading the severity of a
+  bug fixed in 0.3.3.2-alpha.  Bug 24700, which was fixed in
+  0.3.3.2-alpha, can be remotely triggered in order to crash relays with
+  a use-after-free pattern. As such, we are now tracking that bug as
+  TROVE-2018-002 and CVE-2018-0491. This bug affected versions
+  0.3.2.1-alpha through 0.3.2.9, as well as 0.3.3.1-alpha.
 
-  Additionally, it fixes several minor bugs and annoyances from
+  This release also fixes several minor bugs and annoyances from
   earlier releases.
 
+  All directory authorities should upgrade to one of the versions
+  released today.  All relays not already running Tor 0.3.3.2-alpha or
+  later should upgrade to one of the versions released today.
+
+  o Major bugfixes (denial-of-service, directory authority):
+    - Fix a protocol-list handling bug that could be used to remotely crash
+      directory authorities with a null-pointer exception. Fixes bug 25074;
+      bugfix on 0.2.9.4-alpha. Also tracked as TROVE-2018-001 and
+      CVE-2018-0490.
+
   o Minor features (compatibility, OpenSSL):
     - Tor will now support TLS1.3 once OpenSSL 1.1.1 is released.
       Previous versions of Tor would not have worked with OpenSSL 1.1.1,
@@ -21,6 +38,14 @@ Changes in version 0.3.3.3-alpha - 2018-03-??
     - Add a "make test-rust" target to run the rust tests only. Closes
       ticket 25071.
 
+  o Minor bugfixes (denial-of-service):
+    - Fix a possible crash on malformed consensus. If a consensus had
+      contained an unparseable protocol line, it could have made clients
+      and relays crash with a null-pointer exception. To exploit this
+      issue, however, an attacker would need to be able to subvert the
+      directory authority system. Fixes bug 25251; bugfix on
+      0.2.9.4-alpha. Also tracked as TROVE-2018-004.
+
   o Minor bugfixes (DoS mitigation):
     - Add extra safety checks when refilling the circuit creation bucket
       to ensure we never set a value above the allowed maximum burst.
@@ -41,6 +66,12 @@ Changes in version 0.3.3.3-alpha - 2018-03-??
       concurrent learning circuits to 10. Fixes bug 24769; bugfix
       on 0.3.1.1-alpha.
 
+  o Minor bugfixes (spec conformance):
+    - Forbid "-0" as a protocol version. Fixes part of bug 25249; bugfix on
+      0.2.9.4-alpha.
+    - Forbid UINT32_MAX as a protocol version.  Fixes part of bug 25249;
+      bugfix on 0.2.9.4-alpha.
+
   o Code simplification and refactoring:
     - Update the "rust dependencies" submodule to be a project-level
       repository, rather than a user repository. Closes ticket 25323.