CVE-2022-44797 : btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other B

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

Published 2022-11-07 04:15:10

Updated 2022-11-14 18:25:34

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2022-44797

Btcd Project » Btcd
Versions before (<) 0.23.2
cpe:2.3:a:btcd_project:btcd:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lightning Network Daemon Project » Lightning Network Daemon

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

https://github.com/btcsuite/btcd/releases/tag/v0.23.2

Release btcd v0.23.2 · btcsuite/btcd · GitHub
Release Notes;Third Party Advisory
https://github.com/btcsuite/btcd/pull/1896

wire: remove erroneous witness size check in wire parsing by Roasbeef · Pull Request #1896 · btcsuite/btcd · GitHub
Patch;Third Party Advisory
https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta

Release lnd v0.15.2-beta · lightningnetwork/lnd · GitHub
Release Notes;Third Party Advisory
https://github.com/lightningnetwork/lnd/issues/7002

[bug]: Fail to chain sync on `testnet3` & `mainnet` errors relating to: script witness item is larger than the max allowed size · Issue #7002 · lightningnetwork/lnd · GitHub
Exploit;Issue Tracking;Third Party Advisory

Jump to