зеркало из https://github.com/golang/vulndb.git
data/reports: add GO-2024-3189
- data/reports/GO-2024-3189.yaml Fixes golang/vulndb#3189 Change-Id: Ib9106c17067bbf85003b7f857bafccdf1b280d3f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/620355 LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Maceo Thompson <maceothompson@google.com> Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
This commit is contained in:
Maceo Thompson
Gopher Robot
Родитель
18bd3a1b73
Коммит
ebbdcbcbe8
|
|
@ -0,0 +1,94 @@
|
|||
{
|
||||
"schema_version": "1.3.1",
|
||||
"id": "GO-2024-3189",
|
||||
"modified": "0001-01-01T00:00:00Z",
|
||||
"published": "0001-01-01T00:00:00Z",
|
||||
"aliases": [
|
||||
"CVE-2024-38365",
|
||||
"GHSA-27vh-h6mc-q6g8"
|
||||
],
|
||||
"summary": "Consensus failure in github.com/btcsuite/btcd",
|
||||
"details": "The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split (accepting an invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An attacker can trigger this vulnerability by constructing a 'standard' Bitcoin transaction that exhibits different behaviors in 'FindAndDelete()' and 'removeOpcodeByData()'.",
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"name": "github.com/btcsuite/btcd",
|
||||
"ecosystem": "Go"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "SEMVER",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"ecosystem_specific": {
|
||||
"imports": [
|
||||
{
|
||||
"path": "github.com/btcsuite/btcd/txscript",
|
||||
"symbols": [
|
||||
"Engine.Execute",
|
||||
"Engine.Step",
|
||||
"VerifyTaprootKeySpend",
|
||||
"baseSegwitSigVerifier.Verify",
|
||||
"baseSigVerifier.Verify",
|
||||
"baseTapscriptSigVerifier.Verify",
|
||||
"opcodeCheckMultiSig",
|
||||
"opcodeCheckSig",
|
||||
"opcodeCheckSigAdd",
|
||||
"opcodeCodeSeparator",
|
||||
"removeOpcodeByData",
|
||||
"taprootSigVerifier.Verify"
|
||||
]
|
||||
}
|
||||
],
|
||||
"custom_ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0.10.0"
|
||||
},
|
||||
{
|
||||
"fixed": "0.24.2-beta.rc1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
|
||||
},
|
||||
{
|
||||
"type": "FIX",
|
||||
"url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"name": "darosior"
|
||||
},
|
||||
{
|
||||
"name": "dergoegge"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"url": "https://pkg.go.dev/vuln/GO-2024-3189",
|
||||
"review_status": "REVIEWED"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,48 @@
|
|||
id: GO-2024-3189
|
||||
modules:
|
||||
- module: github.com/btcsuite/btcd
|
||||
non_go_versions:
|
||||
- introduced: 0.10.0
|
||||
- fixed: 0.24.2-beta.rc1
|
||||
vulnerable_at: 0.24.0
|
||||
packages:
|
||||
- package: github.com/btcsuite/btcd/txscript
|
||||
symbols:
|
||||
- opcodeCheckMultiSig
|
||||
- taprootSigVerifier.Verify
|
||||
- opcodeCodeSeparator
|
||||
- baseSegwitSigVerifier.Verify
|
||||
- baseSigVerifier.Verify
|
||||
- removeOpcodeByData
|
||||
- opcodeCheckSig
|
||||
- VerifyTaprootKeySpend
|
||||
- opcodeCheckSigAdd
|
||||
- baseTapscriptSigVerifier.Verify
|
||||
derived_symbols:
|
||||
- Engine.Execute
|
||||
- Engine.Step
|
||||
summary: Consensus failure in github.com/btcsuite/btcd
|
||||
description: |-
|
||||
The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement
|
||||
Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the
|
||||
validation of Bitcoin blocks. This can lead to a chain split (accepting an
|
||||
invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An
|
||||
attacker can trigger this vulnerability by constructing a 'standard' Bitcoin
|
||||
transaction that exhibits different behaviors in 'FindAndDelete()' and
|
||||
'removeOpcodeByData()'.
|
||||
cves:
|
||||
- CVE-2024-38365
|
||||
ghsas:
|
||||
- GHSA-27vh-h6mc-q6g8
|
||||
credits:
|
||||
- darosior
|
||||
- dergoegge
|
||||
references:
|
||||
- advisory: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8
|
||||
- fix: https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5
|
||||
- web: https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184
|
||||
- web: https://github.com/btcsuite/btcd/releases/tag/v0.24.2
|
||||
source:
|
||||
id: GHSA-27vh-h6mc-q6g8
|
||||
created: 2024-10-14T16:05:08.379064-04:00
|
||||
review_status: REVIEWED
|
||||
Загрузка…
Ссылка в новой задаче