reticulum @ 1.1.9
integrity
- size
- 20.5 MiB
- downloaded
- last checked
release notes
This maintenance release fixes a critical security issue, that would allow an attacker to craft a BZ2 decompression bomb via Resource transfers or Buffer StreamDataMessage, causing an out-of-memory condition and crashing the receiving process via OOM killer.
Big thanks to @ratspeak for discovering and reporting this vulnerability!
Changes
- Fixed bz2 decompression bomb vulnerability in Resource transfer assembly and Buffer StreamDataMessage unpacking.
Release Hashes
39a131aeb5d76fd73bfc67f68135f49ab0cf8628af154e04096a05c208ce77b6 rns-1.1.9-py3-none-any.whl
aab7bfc8c65514c9bdf4c22f00d288faf6c9e1777fc002dbe3eb29c286e67128 rnspure-1.1.9-py3-none-any.whl
Release Signatures
Release artifacts include rsg signature files that can be validated against the RNS release signing identity <bc7291552be7a58f361522990465165c> using rnid:
rnid -i bc7291552be7a58f361522990465165c -V rns-1.1.9-py3-none-any.whl.rsg
download
unix · zip
curl -fL -o 1.1.9.zip https://ratatoskr.space/pkg/reticulum/1.1.9.zip
printf '%s %s\n' '965575310c57cf7c22bd2df6c8607b8621bc2ceb9313a966f8aaf032e45375e2' '1.1.9.zip' | sha256sum -c -
windows · zip
$url = "https://ratatoskr.space/pkg/reticulum/1.1.9.zip"
$out = "1.1.9.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "965575310c57cf7c22bd2df6c8607b8621bc2ceb9313a966f8aaf032e45375e2") { throw "sha256 mismatch" }
unix · tar.gz
curl -fL -o 1.1.9.tar.gz https://ratatoskr.space/pkg/reticulum/1.1.9.tar.gz
printf '%s %s\n' 'bc25c313cf680e35b2d6dab76e2860c303b705635ddbb5b099f33317f61f273c' '1.1.9.tar.gz' | sha256sum -c -
windows · tar.gz
$url = "https://ratatoskr.space/pkg/reticulum/1.1.9.tar.gz"
$out = "1.1.9.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "bc25c313cf680e35b2d6dab76e2860c303b705635ddbb5b099f33317f61f273c") { throw "sha256 mismatch" }
download via yggdrasil mesh
unix · zip
curl -fL -o 1.1.9.zip http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.zip
printf '%s %s\n' '965575310c57cf7c22bd2df6c8607b8621bc2ceb9313a966f8aaf032e45375e2' '1.1.9.zip' | sha256sum -c -
windows · zip
$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.zip"
$out = "1.1.9.zip"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "965575310c57cf7c22bd2df6c8607b8621bc2ceb9313a966f8aaf032e45375e2") { throw "sha256 mismatch" }
unix · tar.gz
curl -fL -o 1.1.9.tar.gz http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.tar.gz
printf '%s %s\n' 'bc25c313cf680e35b2d6dab76e2860c303b705635ddbb5b099f33317f61f273c' '1.1.9.tar.gz' | sha256sum -c -
windows · tar.gz
$url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.tar.gz"
$out = "1.1.9.tar.gz"
Invoke-WebRequest -Uri $url -OutFile $out
if ((Get-FileHash $out -Algorithm SHA256).Hash.ToLowerInvariant() -ne "bc25c313cf680e35b2d6dab76e2860c303b705635ddbb5b099f33317f61f273c") { throw "sha256 mismatch" }
| artifact | format | size | hashes |
|---|---|---|---|
| 1.1.9.zip | zip | 20.6 MiB |
blake3-24 8acf3c9bef078750f039f7c859ca3a77c64f56dee9992dcd
sha256 965575310c57cf7c22bd2df6c8607b8621bc2ceb9313a966f8aaf032e45375e2
sha1 cd0bcd980bd9c54f98905890445207c4f1135004
|
| 1.1.9.tar.gz | tar.gz | 20.4 MiB |
blake3-24 6dfc74cead95020e1b0f6685d389a05564c1b0fb12d69007
sha256 bc25c313cf680e35b2d6dab76e2860c303b705635ddbb5b099f33317f61f273c
sha1 56dec4e303f8041da6e013b7e601467bcfca060a
|
install
bazel
http_archive(
name = "reticulum",
urls = ["https://ratatoskr.space/pkg/reticulum/1.1.9.tar.gz"],
integrity = "sha256-vCXDE89oDjWy1tq3bihgwwO3BWNd27WwmfMzF/YfJzw=",
strip_prefix = "reticulum-1.1.9",
)
zig
.url = "https://ratatoskr.space/pkg/reticulum/1.1.9.tar.gz",
install via yggdrasil mesh
bazel
http_archive(
name = "reticulum",
urls = ["http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.tar.gz"],
integrity = "sha256-vCXDE89oDjWy1tq3bihgwwO3BWNd27WwmfMzF/YfJzw=",
strip_prefix = "reticulum-1.1.9",
)
zig
.url = "http://14cc7d57b5e70f679b851fe5b272ce17c70632ff4beb5b35ab64bc706b2485af.pk.ygg/pkg/reticulum/1.1.9.tar.gz",