GO-2024-2818

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2024-2818

Import Source

https://vuln.go.dev/ID/GO-2024-2818.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2024-2818

Aliases

Published

2024-05-08T17:51:16Z

Modified

2024-05-20T16:03:47Z

Summary

Consensus failures in github.com/btcsuite/btcd

Details

Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2024-2818"
}

References

Credits

- Niklas Gögge

Affected packages

Go / github.com/btcsuite/btcd

Package

Name: github.com/btcsuite/btcd; View open source insights on deps.dev
Purl: pkg:golang/github.com/btcsuite/btcd

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.24.0

Ecosystem specific

{
    "imports": [
        {
            "symbols": [
                "BlockChain.CalcSequenceLock",
                "BlockChain.CheckConnectBlockTemplate",
                "BlockChain.ProcessBlock",
                "BlockChain.calcSequenceLock",
                "ValidateTransactionScripts",
                "txValidator.Validate"
            ],
            "path": "github.com/btcsuite/btcd/blockchain"
        },
        {
            "symbols": [
                "Engine.Execute",
                "Engine.Step",
                "opcodeCheckSequenceVerify"
            ],
            "path": "github.com/btcsuite/btcd/txscript"
        }
    ]
}