Whonix 18.2.1.9 - Point Release!

News
1

Download

(What is a point release?)

Upgrade

Alternatively, an in-place release upgrade is possible using the Whonix repository.

This release would not have been possible without the numerous supporters of Whonix!

Please Donate!

Please Contribute!

Major Changes

  • updated Kicksecure: Kicksecure 18.2.1.9 - Point Release! - News - Kicksecure Forums

  • Internal security review

  • External security audit: Work in progress.

  • Improved derivative-maker automated tests: github native CI for builds (Thanks to @Mycobee!)

  • kloak:

    • CodeQL, Coverity and fuzzing

  • anon-meta-packages:

  • onion-grater:

    • security: fix Bisq onion-grater profile deanonymization vulnerability The Bisq onion-grater profile contained an unsafe regex that would allow a compromised Whonix-Workstation to deanonymize the user by sending a crafted Tor control protocol command. The Bisq onion-grater profile is optional and is not enabled by default. Vulnerable users: Users who ran the command sudo onion-grater-add 40_bisq. Users are encouraged to run this command by Bisq: The P2P Exchange Network as part of setting up Bisq, so any users who followed these instructions are very likely to be affected. The updated onion-grater profile fixes the issue. No user action is required beyond installing a version of onion-grater that includes the fixed profile. Attribution: Thanks to 0x6d (https://0x6d.net) for the responsible private security bug report found during a Whonix security audit. (Thanks to @ArrayBolt3!)
    • Add mremap to system call filter whitelist glibc uses it internally as part of realloc(), which Python calls numerous times internally. (Thanks to @ArrayBolt3!)

  • legacy-dist:

    • Fix kloak failing to start after a Whonix-Workstation 17 release upgrade (Thanks to @ArrayBolt3!)
    • Fix release upgrade bug caused by usability-misc’s policy-rc.d disappearing mid-upgrade (Thanks to @ArrayBolt3!)

  • rewrite of, and work towards Whonix-Windows-Installer and Whonix-Windows-Starter (Thanks to @ArrayBolt3!)

  • Apple M# Silicon (ARM64) build system improvements: VirtualBox operations were moved from the host into an amd64 cowbuilder chroot, allowing ARM64 hosts such as Apple Silicon systems to produce VirtualBox images without requiring VirtualBox packages on the host.

Full difference of all changes

https://github.com/Whonix/derivative-maker/compare/18.1.4.2-developers-only…18.2.1.0-developers-only

(This forum post was previously a call for testers. No release critical bugs where found during the testing period. This forum post was therefore transformed into a stable release announcement. See edit history.)

2 Likes