0.9.14 includes critical fixes for XSS and remote execution vulnerabilities reported by Exodus Intelligence. As an added precaution, we have disabled several advanced configuration features in the router console, including installation of new plugins. We plan to re-enable these in a future release after additional review.
Due to I2P library changes, I2P-Bote users must upgrade their plugin to version 0.2.10 to work with I2P 0.9.14. Your router should update the plugin automatically after the router restarts.
La version contient aussi plusieurs correctifs de bogues dans 2ptunnel, i2psnark et autres, et met à jour vers les dernières versions de Jetty, Tomcat et Wrapper. Nous avons aussi mis en oeuvre une méthode de plus rapide et plus sûre de réensemencement. Il y a, bien sûr, la collection habituelle de correctifs de bogues mineurs et de mise à jour des traductions.
You must update to this release immediately. The best way to maintain security and help the network is to run the latest release.
DÉTAILS SUR LA VERSION
Security Fixes
- Fix several XSS issues
- Disable changing news feed URL from UI
- Disable plugin install
- Disable setting unsigned update URL from UI
- Disable clients.config editing from the UI
- Add Content-Security-Policy and X-XSS-Protection headers
- Disable unused ExecNamingService (thx joernchen of Phenoelit)
Correctifs de bogues
- Fix tunnel building so it doesn't get "stuck" on a single pool
- Reject participating tunnels when hidden
- Several i2psnark improvements and fixes (GUI and DHT), including changes for better compatibility with Vuze
Autre
- Le réensemencement récupère maintenant un fichier zip signé contenant les infos de routeur, par sécurité et rapidité
- Use JVM's AES implementation if it is faster
- Plus d’options évoluées affichées sur les pages de modification d’I2PTunnel.
- Per-message reliabilitiy settings in I2CP and error propagation back from router to client
- Lots of findbugs fixes and cleanups
- Support signature types in SAM, bump rev to 3.1
- New event log page in console
- Jetty 8.1.15.v20140411
- Tomcat 6.0.41
- Wrapper 3.5.25 (new installs and PPA only)
- Mises à jour de traduction
- Mise à jour des données GeoIP (nouvelles installations et PPA seulement)
Sommes de contrôle SHA256 :
8e400551866c790e72d14d6f340653cb6e8c4c323cc8124f65200ec38a78aa75 i2pinstall_0.9.14_windows.exe a3731f5ac0ca1fab4777ec9894e5064a576e9805785027a49850b9857898ef0a i2pinstall_0.9.14.jar 30bb7bbfd1ff829dab048bbb6264d6cf20b2a01511e7cddd4fc13771feb6a780 i2psource_0.9.14.tar.bz2 404b0e6997474097cf7bd7ca006e59442d502b178dd3dd5de16e26d99a152ceb i2pupdate_0.9.14.zip 94eb8e05df8b9d95e034810c6132c51634acb3e7f7c9ece8f473af238740a27d i2pupdate.su2 fe64bfd41710a97bc6b0ceeebd95a99f0c757c6c815e9cf8c6a0c336043add91 i2pupdate.su3 38b1966729e464696c6bace65e38fbdeb0a750f227a9f6b40b30ab498eff83ac i2pupdate.sud