Lucene search

[email protected]CVE-2020-26895

HistoryOct 21, 2020 - 2:15 a.m.

CVE-2020-26895

2020-10-2102:15:12

CWE-354

[email protected]

web.nvd.nist.gov

cve-2020-26895

lnd

lightning network daemon

high-s signature

fund loss

security vulnerability

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.5%

JSON

Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.

Affected configurations

NVD

Node

lightning_network_daemon_projectlightning_network_daemonMatch0.1alpha

lightning_network_daemon_projectlightning_network_daemonMatch0.1.1alpha

lightning_network_daemon_projectlightning_network_daemonMatch0.2alpha

lightning_network_daemon_projectlightning_network_daemonMatch0.2.1alpha

lightning_network_daemon_projectlightning_network_daemonMatch0.3alpha

lightning_network_daemon_projectlightning_network_daemonMatch0.4beta

lightning_network_daemon_projectlightning_network_daemonMatch0.4.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.4.2beta

lightning_network_daemon_projectlightning_network_daemonMatch0.5beta

lightning_network_daemon_projectlightning_network_daemonMatch0.5beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.5beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.5.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.5.1beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.5.1beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.5.1beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.5.1beta_rc4

lightning_network_daemon_projectlightning_network_daemonMatch0.5.2beta

lightning_network_daemon_projectlightning_network_daemonMatch0.6beta

lightning_network_daemon_projectlightning_network_daemonMatch0.6beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.6beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.6beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.6beta_rc4

lightning_network_daemon_projectlightning_network_daemonMatch0.6.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.6.1beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.6.1beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.7.0beta

lightning_network_daemon_projectlightning_network_daemonMatch0.7.0beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.7.0beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.7.0beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.7.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.7.1beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.7.1beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.8.0beta

lightning_network_daemon_projectlightning_network_daemonMatch0.8.0beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.8.0beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.8.0beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.8.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.8.2beta

lightning_network_daemon_projectlightning_network_daemonMatch0.8.2beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.8.2beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.9.0beta

lightning_network_daemon_projectlightning_network_daemonMatch0.9.0beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.9.0beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.9.0beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.9.0beta_rc4

lightning_network_daemon_projectlightning_network_daemonMatch0.9.1beta

lightning_network_daemon_projectlightning_network_daemonMatch0.9.1beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.9.2beta

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc1

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc2

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc3

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc4

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc5

lightning_network_daemon_projectlightning_network_daemonMatch0.10.0beta_rc6

CPENameOperatorVersion
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.1
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.1.1
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.2
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.2.1
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.3
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.4
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.4.1
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.4.2
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.5
lightning_network_daemon_project:lightning_network_daemonlightning network daemon project lightning network daemoneq0.5.1

CPE	Name	Operator	Version
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.1
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.1.1
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.2
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.2.1
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.3
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.4
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.4.1
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.4.2
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.5
lightning_network_daemon_project:lightning_network_daemon	lightning network daemon project lightning network daemon	eq	0.5.1

Rows per page:

1-10 of 221

References

gist.github.com/ariard/fb432a9d2cd3ba24fdc18ccc8c5c6eb4

lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002856.html

lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002858.html

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.5%

JSON

Related for CVE-2020-26895

prion1 nvd1 osv1 cvelist1