I2P 2.3.0 - Security Fixes, Tweakable blocklists, DTG API
++ This release contains fixes for CVE-2023-36325. + CVE-2023-36325 is a context-confusion bug which occurred in the bloom filter. + An attacker crafts an I2NP message containing a unique messageID, and sends that messageID to a client. + The message, after passing through the bloom filter, is not allowed to be re-used in a second message. + The attacker then sends the same message directly to the router. + The router passes the message to the bloom filter, and is dropped. + This leaks the information that the messageID has been seen before, giving the attacker a strong reason to believe that the router is hosting the client. + This has been fixed by separting the bloom filter's functionality into different contexts based on whether a message came down a client tunnel, an exploratory tunnel, was sent to the router directly. + Under normal circumstances, this attack takes several days to perform successfully and may be confounded by several factors such as routers restarting during the attack phase and sensitivity to false-positives. + Users of Java I2P are recommended to update immediately to avoid the attack. +
++ In the course of fixing this context confusion bug, we have revised some of our strategies to code defensively, against these types of leaks. + This includes tweaks to the netDb, the rate-limiting mechanisms, and the behavior of floodfill routers. +
++ This release adds not_bob as a second default hosts provider, and adds notbob.i2p and ramble.i2p to the console homepage. +
++ This release also contains a tweakable blocklist. + Blocklisting is semi-permanent, each blocked IP address is normally blocked until the router is restarted. + Users who observe explosive blocklist growth during sybil attacks may opt-in to shorter timeouts by configuring the blocklist to expire entries at an interval. + This feature is off-by-default and is only recommended for advanced users at this time. +
++ This release also includes an API for plugins to modify with the Desktop GUI(DTG). + It is now possible to add menu items to the system tray, enabling more intuitive launching of plugins which use native application interfaces. +
++ As usual, we recommend that you update to this release. + The best way to maintain security and help the network is to run the latest release. +
+