# Stable release 0.4.8.14
**URL:** https://forum.torproject.org/t/stable-release-0-4-8-14/17242
**Category:** Tor Release Announcement
**Tags:** tor
**Created:** [February 5, 2025, 2:54pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242 "2025-02-05T14:54:15Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@dgoulet](https://forum.torproject.org/u/dgoulet)
#### Post date: [February 5, 2025, 2:54pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/1 "2025-02-05T14:54:15Z")
# Where to Download
- [Tarballs](https://dist.torproject.org/)
- [Gitlab Repository](https://gitlab.torproject.org/tpo/core/tor)
- [Bug Report](https://gitlab.torproject.org/tpo/core/tor/-/issues/new)
# Changes
Below are the major changes of the released versions and links to more detailed release notes.
## Stable
Today, we release tor stable version **0.4.8.14** which fixes a major bug affecting onion service directory cache (HSDir).
Another reason for this release is that the fallback directory list had more than 25% of its relays unreachable or out of the consensus.
Please, upgrade as soon as possible! 🙂
#### Release Notes
- [0.4.8.x](https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes)
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [February 5, 2025, 5:48pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/2 "2025-02-05T17:48:33Z")
> [@dgoulet](#):
>
> Please, upgrade as soon as possible! 🙂
What users of 0.4.9.1-alpha should do?
---
### Author:  [@atari](https://forum.torproject.org/u/atari)
#### Post date: [February 5, 2025, 6:15pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/3 "2025-02-05T18:15:24Z")
Will there be an updated package in the Debian repo soon? [Debian -- Details of package tor in bookworm-backports](https://packages.debian.org/bookworm-backports/tor)
---
### Author:  [@everydayisoks](https://forum.torproject.org/u/everydayisoks)
#### Post date: [February 6, 2025, 9:42am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/4 "2025-02-06T09:42:10Z")
I’m glad to see that Tor has finally fixed the bug about the HSDir cache. Last year, a paper published at the [WWW](https://www2024.thewebconf.org/) conference exploited this vulnerability to implement a denial-of-service attack on the Onion service. The attack can stealthily attack any onion service and requires very little spending.
Paper Link:[HSDirSniper: A New Attack Exploiting Vulnerabilities in Tor’s Hidden Service Directories](https://dl.acm.org/doi/10.1145/3589334.3645591)
---
### Author:  [@everydayisoks](https://forum.torproject.org/u/everydayisoks)
#### Post date: [February 6, 2025, 10:21am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/5 "2025-02-06T10:21:27Z")
I am happy to help Tor find and test vulnerabilities in the protocol. And I recommend that the Tor team pay attention to the teams working on Tor, such as the team working on this paper. Keeping up with the latest research is good for making Tor more secure.
---
### Author:  [@gus](https://forum.torproject.org/u/gus)
#### Post date: [February 6, 2025, 9:37pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/6 "2025-02-06T21:37:26Z")
Hi @everydayisoks, we appreciate responsible disclosure and encourage researchers to contact [security@torproject.org](mailto:security@torproject.org) as far as possible in advance. This allows the Tor Project to collaborate on improving the quality and accuracy of their research, verify findings, and work on mitigating potential vulnerabilities before they become public.
We can offer assurances of confidentiality, and correct handling of pre-print papers that are either under submission or review. Many researchers follow this approach, leading to more productive and fruitful collaborations and stronger security for the Tor network.
If you know the authors, please share this comment with them. Thank you!
---
### Author:  [@anong](https://forum.torproject.org/u/anong)
#### Post date: [February 20, 2025, 10:11pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/7 "2025-02-20T22:11:11Z")
Any Idea when Debian and FreeBSD packages will arrive?
> [@dgoulet](#):
>
> Please, upgrade as soon as possible! 🙂
Still no updated packages in Debian repos and FreeBSD ports after two weeks. Do we need to update manually or should we just wait?
---
### Author:  [@toralf](https://forum.torproject.org/u/toralf)
#### Post date: [February 21, 2025, 12:23am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/8 "2025-02-21T00:23:03Z")
I do not use Debian packages since a year. Instead I do build Tor from sources.
---
### Author:  [@atari](https://forum.torproject.org/u/atari)
#### Post date: [February 21, 2025, 7:57am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/9 "2025-02-21T07:57:42Z")
> [@toralf](#):
>
> I do not use Debian packages since a year. Instead I do build Tor from sources.
Do you still build a Debian package or just plain tor without Debian scripts and diffs?
---
### Author:  [@toralf](https://forum.torproject.org/u/toralf)
#### Post date: [February 21, 2025, 11:48am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/10 "2025-02-21T11:48:29Z")
I just build from source [1]
[1] [tor-relays/playbooks/roles/setup\_tor/tasks/tor-src.yaml at main · toralf/tor-relays · GitHub](https://github.com/toralf/tor-relays/blob/main/playbooks/roles/setup_tor/tasks/tor-src.yaml)
---
### Author:  [@Kemp](https://forum.torproject.org/u/Kemp)
#### Post date: [February 22, 2025, 8:15am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/11 "2025-02-22T08:15:21Z")
Hi
There’s still no updated package for Debian stable in [deb.tpo.org](http://deb.tpo.org) repos after 2 weeks? If there’s not going to be updates anymore at all, this could leave some public relays using outdated versions.
---
### Author:  [@dougc](https://forum.torproject.org/u/dougc)
#### Post date: [February 25, 2025, 6:23am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/12 "2025-02-25T06:23:56Z")
Getting this error when trying to update tor in Ubuntu 22.04 LTS, similar error in 24.04 LTS using sudo apt update… Just started in the last day or so.
> 404 Not Found [IP: [204.8.99.144](http://204.8.99.144) 443]
> Reading package lists… Done
> E: The repository ‘[Index of /torproject.org](https://deb.torproject.org/torproject.org) jammy Release’ no longer has a Release file.
> N: Updating from such a repository can’t be done securely, and is therefore disabled by default.
> N: See apt-secure(8) manpage for repository creation and user configuration details.
---
### Author:  [@ebanam](https://forum.torproject.org/u/ebanam)
#### Post date: [February 25, 2025, 11:28am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/13 "2025-02-25T11:28:58Z")
We have a ticket about this on the bug tracker, [[URGENT] Deleted many important folders from the deb.tpo repository (jammy, noble, bullseye, etc) (#42052) · Issues · The Tor Project / TPA / TPA team · GitLab](https://gitlab.torproject.org/tpo/tpa/team/-/issues/42052)
---
### Author:  [@yurikoles](https://forum.torproject.org/u/yurikoles)
#### Post date: [February 25, 2025, 1:46pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/14 "2025-02-25T13:46:46Z")
I don’t have an account on Tor’s GitLab, so I post here
@weasel wrote on the GitLab [1 hour ago](https://gitlab.torproject.org/tpo/tpa/team/-/issues/42052#note_3164403):
> The tor’s gitlab CI no longer has good support for anything that is not a current Debian adm64.
>
> As such, I recommend you use the packages provided in Debian (in bookworm-backports if you are running stable).
This message conflicts with statement on Tor’s deb repository support page:
> #### [Can I use tor from Ubuntu’s repository?](https://support.torproject.org/apt/#apt_tor-ubuntu)
>
> **No.** Do not use the packages in Ubuntu’s universe. In the past they have not been reliably updated. That means you could be missing stability and security fixes. Instead, please use [Tor Debian repository](https://support.torproject.org/apt/tor-deb-repo/).
I want to remind that issue is about disappearance of Tor’s _Ubuntu_ repositories and Tor website argues against using stock Ubuntu packages from `universe`.
---
### Author:  [@Kemp](https://forum.torproject.org/u/Kemp)
#### Post date: [February 25, 2025, 5:16pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/15 "2025-02-25T17:16:40Z")
0.4.8.14 update for Debian bookworm seems to be working as of 24.2. Good job!
---
### Author:  [@twofaktor](https://forum.torproject.org/u/twofaktor)
#### Post date: [February 26, 2025, 5:42am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/16 "2025-02-26T05:42:15Z")
Already on Tor status page as a well-known issue:
> **[Issues with Ubuntu packages on deb.torproject.org and its Onion Service | Tor...](https://status.torproject.org/issues/2025-02-25-ubuntu-packages/)**
>
> We are aware of two issues related to deb.torproject.org that we are working on fixing:
> The first issue is the Ubuntu packages are missing when using apt. Tor has, for a while, had flaky CI across our entire infrastructure due to Docker upstream...
---
### Author:  [@catharsis](https://forum.torproject.org/u/catharsis)
#### Post date: [February 26, 2025, 5:43am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/17 "2025-02-26T05:43:32Z")
I understand that the Ubuntu repository issue is being worked on, but can something be done in the interim to fix `apt update` besides expecting thousands of people to temporarily disable the repository and then re-enable it later?
Maybe put the previous version back where it was, or put a placeholder/empty Release file so `apt update` won’t get a 404 and bomb out?
---
### Author:  [@twofaktor](https://forum.torproject.org/u/twofaktor)
#### Post date: [February 28, 2025, 4:19pm UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/18 "2025-02-28T16:19:09Z")
Resolved: [Issues with Ubuntu packages on deb.torproject.org and its Onion Service | Tor Project status](https://status.torproject.org/issues/2025-02-25-ubuntu-packages/)
---
### Author:  [@opxf](https://forum.torproject.org/u/opxf)
#### Post date: [March 1, 2025, 11:25am UTC](https://forum.torproject.org/t/stable-release-0-4-8-14/17242/19 "2025-03-01T11:25:43Z")
Nice update, ty