MEDIUM
GHSA-3jgf-r68h-xfqm
btcd susceptible to consensus failures
Quick fix
GHSA-3jgf-r68h-xfqm — github.com/btcsuite/btcd: upgrade to the fixed version with the command below.
go get github.com/btcsuite/btcd@v0.24.0Details
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/btcsuite/btcd
Introduced in:
0Fixed in: 0.24.0Fix
go get github.com/btcsuite/btcd@v0.24.0References
- https://nvd.nist.gov/vuln/detail/CVE-2024-34478[ADVISORY]
- https://github.com/btcsuite/btcd/pull/1981[WEB]
- https://github.com/btcsuite/btcd/commit/253b688c68b89eca7eb75d4d5443dbdbc928db3c[WEB]
- https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455[WEB]
- https://github.com/btcsuite/btcd[PACKAGE]
- https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3[WEB]
- https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3[WEB]
- https://pkg.go.dev/vuln/GO-2024-2818[WEB]