CRITICAL9.8
GHSA-2chg-86hq-7w38
btcd mishandles witness size checking
Quick fix
GHSA-2chg-86hq-7w38 — github.com/btcsuite/btcd: upgrade to the fixed version with the command below.
go get github.com/btcsuite/btcd@v0.23.2Details
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
### Specific Go Packages Affected github.com/btcsuite/btcd/wire
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/btcsuite/btcd
Introduced in:
0Fixed in: 0.23.2Fix
go get github.com/btcsuite/btcd@v0.23.2Go/github.com/lightningnetwork/lnd
Introduced in:
0Fixed in: 0.15.2-betaFix
go get github.com/lightningnetwork/lnd@v0.15.2-betaReferences
- https://nvd.nist.gov/vuln/detail/CVE-2022-44797[ADVISORY]
- https://github.com/lightningnetwork/lnd/issues/7002[WEB]
- https://github.com/btcsuite/btcd/pull/1896[WEB]
- https://github.com/btcsuite/btcd/commit/7fdaf6958781df46fffee4bc8bee38801c066da8[WEB]
- https://github.com/btcsuite/btcd[PACKAGE]
- https://github.com/btcsuite/btcd/releases/tag/v0.23.2[WEB]
- https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta[WEB]
- https://pkg.go.dev/vuln/GO-2022-1098[WEB]