and forward-port the 0.2.0.26-rc notes

svn:r14692

diff --git a/ChangeLog b/ChangeLog
index 7351711a2c577dd79bf83e29ca75f87c69491ab2..2d722b967079f8ebab8ced30bb5a6418a0c2aed9 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -108,6 +108,27 @@ Changes in version 0.2.1.1-alpha - 2008-??-??
       two parallel lists in lockstep.
 
 
+Changes in version 0.2.0.26-rc - 2008-05-13
+  Tor 0.2.0.26-rc fixes a major security vulnerability caused by a bug
+  in Debian's OpenSSL packages. All users running any 0.2.0.x version
+  should upgrade, whether they're running Debian or not.
+
+  o Major security fixes:
+    - Use new V3 directory authority keys on the tor26, gabelmoo, and
+      moria1 V3 directory authorities. The old keys were generated with
+      a vulnerable version of Debian's OpenSSL package, and must be
+      considered compromised. Other authorities' keys were not generated
+      with an affected version of OpenSSL.
+
+  o Major bugfixes:
+    - List authority signatures as "unrecognized" based on DirServer
+      lines, not on cert cache. Bugfix on 0.2.0.x.
+
+  o Minor features:
+    - Add a new V3AuthUseLegacyKey option to make it easier for
+      authorities to change their identity keys if they have to.
+
+
 Changes in version 0.2.0.25-rc - 2008-04-23
   Tor 0.2.0.25-rc makes Tor work again on OS X and certain BSDs.