GO-2022-1098

vendorUSosv

Denial of service in message decoding in github.com/btcsuite/btcd

view advisory published 2022-11-08Licence: per source

Erroneous message decoding can cause denial of service. Improper checking of maximum witness size during node message decoding prevented nodes in Lightning Labs lnd (before 0.15.2-beta) to sync.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-44797US	critical9.8	1.30% (70th)	—	2022-11-07
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-2chg-86hq-7w38ADVISORY
https://github.com/btcsuite/btcd/pull/1896/commits/f523d4ccaa5f34a2f761f16a05f5d6e6665b1168FIX
https://github.com/btcsuite/btcd/releases/tag/v0.23.2WEB
https://github.com/lightningnetwork/lnd/issues/7002REPORT

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan