PT-2020-16537 · Lightning Network Daemon · Lnd

Published 2020-10-21 · Updated 2024-01-19 · CVE-2020-26895

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions LND versions prior to 0.10.0-beta

Description The issue allows any peer with an open channel to exploit the vulnerability, regardless of the victim's situation, such as being a routing node, payment-receiver, or payment-sender. This can lead to a loss of funds in certain situations. The vulnerability is related to the acceptance of a counterparty high-S signature and the broadcast of invalid local commitment/HTLC transactions.

Recommendations For versions prior to 0.10.0-beta, upgrade to a version 0.11.x release as soon as possible. At the moment, there is no information about other mitigation measures for this vulnerability.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-26895

Affected Products

Lnd

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-26895 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26895 · Vendor Advisory
• https://twitter.com/dpuellARK___/status/1747923778510749960 · Twitter Post
• https://twitter.com/reibiz/status/1748333918573474133 · Twitter Post
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002856.html · Note
• https://twitter.com/reibiz/status/1748334018427224475 · Twitter Post
• https://twitter.com/dpuellARK___/status/1747923866163241039 · Twitter Post
• https://twitter.com/reibiz/status/1748333968473121127 · Twitter Post
• https://gist.github.com/ariard/fb432a9d2cd3ba24fdc18ccc8c5c6eb4 · Note
• https://t.me/cibsecurity/15432 · Telegram Post
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002858.html · Note