PT-2021-23355 · Blockstream · C-Lightning

Eugene Siegel · Published 2021-10-04 · Updated 2022-07-12 · CVE-2021-41592

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Blockstream c-lightning versions through 0.10.1

Description The issue allows for loss of funds due to dust HTLC exposure.

Recommendations For versions through 0.10.1, update to a version that fixes the dust HTLC exposure issue to prevent loss of funds.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-41592

Affected Products

C-Lightning

References · 9

• https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003257.html · Vendor Advisory
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-May/002714.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41592 · Security Note
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2021-October/003264.html · Vendor Advisory
• https://github.com/ElementsProject/lightning · Note
• https://bitcoinmagazine.com/technical/good-griefing-a-lingering-vulnerability-on-lightning-network-that-still-needs-fixing · Note
• https://t.me/cvenotify/21896 · Telegram Post
• https://t.me/cibsecurity/29897 · Telegram Post