PT-2020-9354 · Unknown · Lightning Network Daemon

Published 2020-01-31 · Updated 2024-08-21 · CVE-2019-12999

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Lightning Network Daemon (lnd) versions prior to 0.7

Description: The issue is related to Incorrect Access Control, allowing attackers to trigger loss of funds. This is due to Improper Access Control in the Lightning Network Daemon.

Recommendations: For versions prior to 0.7, update to version 0.7 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive functions to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2019-12999

GHSA-78HJ-86CR-6J2V

GO-2022-0807

Affected Products

Lightning Network Daemon

References · 10

• 🔥 https://github.com/lightninglabs/chanleakcheck · Exploit
• 🔥 https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html · Exploit
• https://github.com/lightningnetwork/lnd/commits/master · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-12999 · Security Note
• https://osv.dev/vulnerability/GO-2022-0807 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-78hj-86cr-6j2v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-12999 · Vendor Advisory
• https://github.com/lightningnetwork/lnd/releases/tag/v0.7.0-beta · Note
• https://github.com/advisories/GHSA-78hj-86cr-6j2v · Note
• https://t.me/cvenotify/723 · Telegram Post