Toggle doesn't work, just refer to the security page.

[wiki] / news / release-1.0.35-and-1.1pre17.mdwn

diff --git a/news/release-1.0.35-and-1.1pre17.mdwn b/news/release-1.0.35-and-1.1pre17.mdwn
index b363543..9a5f0b0 100644 (file)
--- a/news/release-1.0.35-and-1.1pre17.mdwn
+++ b/news/release-1.0.35-and-1.1pre17.mdwn
@@ -6,14 +6,4 @@ Versions 1.0.35 and 1.1pre17 released.
 * Prevent oracle attacks (CVE-2018-16737, CVE-2018-16738).
 * Prevent a MITM from forcing a NULL cipher for UDP (CVE-2018-16758).
 
-Thanks to Michael Yonli for auditing tinc and reporting these vulnerabilities.
-
-[[!toggle id="fulltext" text="Show full text."]]
-
-[[!toggleable  id="fulltext" text="""
-Michael Yonli discovered two security flaws. The first is an issue with the implementation of the authentication protocol used in tinc 1.0, which allows a remote attacker to establish an authenticated connection with a node in the VPN, and send messages one-way. In tinc 1.0.29 and earlier, this is unfortunately trivial to exploit. In tinc 1.0.30 to 1.0.34, the mitigations implemented for the Sweet32 attack also make this attack much harder, but in principle still possible. This is fixed in tinc 1.0.35.
-
-The second issue allows a man-in-the-middle that has intercepted the TCP connection between two nodes, to potentially force one of the nodes to start sending unencrypted UDP packets. This is also fixed in tinc 1.0.35.
-
-The new protocol used in tinc 1.1 is not affected by these vulnerabilities. However, since it is backwards compatible with tinc 1.0, it uses the legacy protocol when communicating with tinc 1.0 nodes. Tinc 1.1pre17 fixes the first issue, and it wasn't vulnerable to the second issue to begin with.
-"""]]
+Thanks to Michael Yonli for auditing tinc and reporting these vulnerabilities. For more information, see the [[security]] page.