GHSA-3jgf-r68h-xfqm

Suggest an improvement
Source
https://github.com/advisories/GHSA-3jgf-r68h-xfqm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3jgf-r68h-xfqm/GHSA-3jgf-r68h-xfqm.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3jgf-r68h-xfqm
Aliases
Published
2024-05-05T03:30:47Z
Modified
2024-08-07T19:55:49Z
Summary
btcd susceptible to consensus failures
Details

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Database specific 
{
    "github_reviewed_at": "2024-05-06T14:28:56Z",
    "nvd_published_at": "2024-05-05T01:15:06Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-436"
    ],
    "github_reviewed": true
}
References

Affected packages

Go / github.com/btcsuite/btcd

Package

Name
github.com/btcsuite/btcd
View open source insights on deps.dev
Purl
pkg:golang/github.com/btcsuite/btcd

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.24.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3jgf-r68h-xfqm/GHSA-3jgf-r68h-xfqm.json"