This release contains fixes for CVE-2023-36325. CVE-2023-36325 is a context-confusion bug which occurred in the bloom filter. An attacker crafts an I2NP message containing a unique messageID, and sends that messageID to a client. The message, after passing through the bloom filter, is not allowed to be re-used in a second message. The attacker then sends the same message directly to the router. The router passes the message to the bloom filter, and is dropped. This leaks the information that the messageID has been seen before, giving the attacker a strong reason to believe that the router is hosting the client. This has been fixed by separting the bloom filter's functionality into different contexts based on whether a message came down a client tunnel, an exploratory tunnel, was sent to the router directly. Under normal circumstances, this attack takes several days to perform successfully and may be confounded by several factors such as routers restarting during the attack phase and sensitivity to false-positives. Users of Java I2P are recommended to update immediately to avoid the attack.
In the course of fixing this context confusion bug, we have revised some of our strategies to code defensively, against these types of leaks. This includes tweaks to the netDb, the rate-limiting mechanisms, and the behavior of floodfill routers.
This release adds not_bob as a second default hosts provider, and adds notbob.i2p and ramble.i2p to the console homepage.
This release also contains a tweakable blocklist. Blocklisting is semi-permanent, each blocked IP address is normally blocked until the router is restarted. Users who observe explosive blocklist growth during sybil attacks may opt-in to shorter timeouts by configuring the blocklist to expire entries at an interval. This feature is off-by-default and is only recommended for advanced users at this time.
This release also includes an API for plugins to modify with the Desktop GUI(DTG). It is now possible to add menu items to the system tray, enabling more intuitive launching of plugins which use native application interfaces.
As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.
DETAILS
Changes
-
netDb: Throttle bursts of netDB lookups
-
Sybil/Blocklist: Allow users to override blocklist expiration with an interval
-
DTG: Provide an API for extending DTG with a plugin
-
Addressbook: add notbob's main addressbook to the default subscriptions.
-
Console: Add Ramble and notbob to console homepage
Bug Fixes
-
Fix replay attack: CVE-2023-36325 Implement handling of multihomed routers in the netDb
-
Fully copy new leaseSets when a leaseSet recievedAsPublished overwrites a leaseSet recievedAsReply