Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update module github.com/btcsuite/btcd from v0.22.2 to v0.24.2 [security] #36

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update module github.com/btcsuite/btcd from v0.22.2 to v0.24.2 [security] #36

wants to merge 1 commit into from

Conversation

figure-renovate[bot]
Copy link
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/btcsuite/btcd v0.22.2 -> v0.24.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-44797

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

Specific Go Packages Affected

github.com/btcsuite/btcd/wire

CVE-2024-34478

btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.

CVE-2024-38365

Impact

The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality. This
logic is consensus-critical: the difference in behavior with the other Bitcoin clients can lead to btcd clients accepting an invalid Bitcoin block (or rejecting a valid one).

This consensus failure can be leveraged to cause a chain split (accepting an invalid Bitcoin block) or be exploited to DoS the btcd nodes (rejecting a valid Bitcoin block). An attacker can create a standard transaction where FindAndDelete doesn't return a match but removeOpCodeByData does making btcd get a different sighash, leading to a chain split. Importantly, this vulnerability can be exploited remotely by any Bitcoin user and does not require any hash power. This is because the difference in behavior can be triggered by a "standard" Bitcoin
transaction, that is a transaction which gets relayed through the P2P network before it gets included in a Bitcoin block.

FindAndDelete vs. removeOpcodeByData

removeOpcodeByData(script []byte, dataToRemove []byte) removes any data pushes from script that contain dataToRemove. However, FindAndDelete only removes exact matches. So for example, with script = "<data> <data||foo>" and dataToRemove = "data" btcd will remove both data pushes but Bitcoin Core's FindAndDelete only removes the first <data> push.

Patches

This has been patched in btcd version v0.24.2-beta.

References

FindAndDelete: GHSA-27vh-h6mc-q6g8

Release Notes

btcsuite/btcd (github.com/btcsuite/btcd)

v0.24.2

Compare Source

This release includes important bug fixes related to subtle interactions related to re-orgs and the UTXO set cache. These fixed are considered security critical.

This release also includes implementations of invalidateblock and reconsiderblock which can be useful in helping nodes that were afflicted by the aforementioned bugs to recover without needing to resync the entire chain.

WIth this release, btcd now also implements the testmempoolaccept RPC which can be useful to check a transaction candidate for validity from a policy and conflict perspective before broadcasting. Along the way, we've added some additional policy checks that exist in other Bitcoin full node implementations.

This release also contains fixes to some parsing issues discovered via fuzz testing.

Finally, as mentioned above release includes important security fixes, with full details to be disclosed in 90 days.

What's Changed

New Contributors

Full Changelog: btcsuite/btcd@v0.24.0...v0.24.2

v0.24.0: btcd v0.24.0

Compare Source

This release is a major release that includes several general bug fixes, security bug fixes (please update!), and also a series of performance improvements that dramatically reduce the time for initial block download from ~45 hours+ to around 6 hours! With this release,btcd now also supports BIP 155 and has gained support for pruning (--prune=MiB).

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightningnetwork/lnd/master/scripts/keys/roasbeef.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-roasbeef-v0.24.0.sig and manifest-v0.24.0.txt are in the current directory) with:

gpg --verify manifest-roasbeef-v0.24.0.sig manifest-v0.24.0.txt

You should see the following if the verification was successful:

gpg: Signature made Sat Dec 30 17:11:22 2023 PST
gpg:                using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306
gpg: Good signature from "Olaoluwa Osuntokun <laolu32@&#8203;gmail.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

What's Changed

New Contributors

Full Changelog: btcsuite/btcd@v0.23.4...v0.24.0

v0.23.4

Compare Source

v0.23.3: btcd v0.23.3

Compare Source

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

curl https://raw.githubusercontent.com/lightningnetwork/lnd/master/scripts/keys/guggero.asc | gpg --import

Once you have the required PGP keys, you can verify the release (assuming manifest-guggero-v0.23.3.sig and manifest-v0.23.3.txt are in the current directory) with:

gpg --verify manifest-guggero-v0.23.3.sig manifest-v0.23.3.txt

You should see the following if the verification was successful:

gpg: Signature made Di 01 Nov 2022 14:00:20 CET
gpg:                using RSA key F4FC70F07310028424EFC20A8E4256593F177720
gpg: Good signature from "Oliver Gugger <gugger@gmail.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

What's Changed

New Contributors

Full Changelog: btcsuite/btcd@v0.23.2...v0.23.3

v0.23.2: btcd v0.23.2

Compare Source

What's Changed

New Contributors

Full Changelog: btcsuite/btcd@v0.23.1...v0.23.2

v0.23.1: btcd v0.23.1-beta

Compare Source

What's Changed

New Contributors

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@figure-renovate figure-renovate bot requested a review from a team as a code owner December 3, 2024 00:37
@figure-renovate
Copy link
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/gin-gonic/gin v1.9.0
go: downloading github.com/pelletier/go-toml/v2 v2.0.6
go: downloading github.com/ugorji/go/codec v1.2.9
go: downloading github.com/mattn/go-isatty v0.0.17
go: downloading github.com/bytedance/sonic v1.8.0
go: downloading github.com/goccy/go-json v0.10.0
go: downloading google.golang.org/protobuf v1.28.1
go: downloading github.com/go-playground/validator/v10 v10.11.2
go: downloading github.com/leodido/go-urn v1.2.1
go: downloading golang.org/x/arch v0.0.0-20210923205945-b76863e36670
go: downloading github.com/klauspost/cpuid/v2 v2.0.9
go: github.com/FigureTechnologies/extkey/cmd/extkey/commands imports
	github.com/btcsuite/btcd/btcec: cannot find module providing package github.com/btcsuite/btcd/btcec

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants