Common Vulnerabilities and Exposures - Revision history

Delcin: Fix for CVE-2023-50428 has been rolled out in bitcoin knots 25.1.knots20231115, this was not updated in the table.

2025-05-26T16:22:43Z

Fix for CVE-2023-50428 has been rolled out in bitcoin knots 25.1.knots20231115, this was not updated in the table.

← Older revision		Revision as of 16:22, 26 May 2025
Line 523:		Line 523:
	\| [[#CVE-2023-50428\|CVE-2023-50428]]		\| [[#CVE-2023-50428\|CVE-2023-50428]]
	\| 2023		\| 2023
	\| ~~All~~ Bitcoin ~~nodes~~		\| Bitcoin core 0.9 and newer (not fixed)<br>Bitcoin Knots 0.9 - 23.0
	\|bgcolor=yellow\| DoS<ref name="DoS"/>		\|bgcolor=yellow\| DoS<ref name="DoS"/>
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy

Luke-jr: updates

2025-05-23T16:50:25Z

updates

@@ Line 464: / Line 464: @@
 |bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/security.html?20213401 64%]
 |-
-| [https://bitcoincore.org/en/2024/07/31/disclose-upnp-oom/ TBD]
+| [https://bitcoincore.org/en/2024/07/31/disclose-upnp-oom/ CVE-2024-52917]
 | 2024-07-31
 | Bitcoin Core/Knots prior to 22.0 with UPnP enabled
@@ Line 471: / Line 471: @@
 | OOM via LAN spam
 |-
-| [https://bitcoincore.org/en/2024/07/31/disclose-addrman-int-overflow/ TBD]
+| [https://bitcoincore.org/en/2024/07/31/disclose-addrman-int-overflow/ CVE-2024-52919]
 | 2024-07-31
 | Bitcoin Core/Knots prior to 22.0
@@ Line 535: / Line 535: @@
 |bgcolor=pink| Easy
 | Script size limit not enforced for Tapscript
+|
 |}

Luke-jr: Add 2 new disclosures

2024-07-31T17:40:13Z

Add 2 new disclosures

@@ Line 463: / Line 463: @@
 | Qt5 remote execution
 |bgcolor=pink| [http://luke.dashjr.org/programs/bitcoin/files/charts/security.html?20213401 64%]
 |-
 | [[#CVE-2021-31876|CVE-2021-31876]]

Luke-jr at 03:40, 4 July 2024

2024-07-04T03:40:59Z

← Older revision		Revision as of 03:40, 4 July 2024
Line 263:		Line 263:
	\| CVE-2015-6031		\| CVE-2015-6031
	\| 2015-09-15		\| 2015-09-15
	\| MiniUPnPc		\| MiniUPnPc<br>Bitcoin Core/Knots prior to 0.11.2
	\|bgcolor=pink\| Anything		\|bgcolor=pink\| Anything
	\|bgcolor=yellow\| LAN		\|bgcolor=yellow\| LAN
Line 318:		Line 318:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-header-spam/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-header-spam/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.14.3		\| Bitcoin Core/Knots prior to 0.15.0
	\|bgcolor=yellow\| DoS<ref name="DoS"/>		\|bgcolor=yellow\| DoS<ref name="DoS"/>
	\|bgcolor=lime\| Easy		\|bgcolor=lime\| Easy
Line 365:		Line 365:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.17.2		\| Bitcoin Core/Knots prior to 0.18.0
	\|bgcolor=yellow\| DoS		\|bgcolor=yellow\| DoS
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
Line 393:		Line 393:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-inv-buffer-blowup/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-inv-buffer-blowup/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.19.2		\| Bitcoin Core/Knots prior to 0.20.0
	\|bgcolor=yellow\| DoS		\|bgcolor=yellow\| DoS
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
Line 400:		Line 400:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-getdata-cpu/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-getdata-cpu/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.19.2		\| Bitcoin Core/Knots prior to 0.20.0
	\|bgcolor=lime\| CPU usage		\|bgcolor=lime\| CPU usage
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
Line 407:		Line 407:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-bip70-crash/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-bip70-crash/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.19.2		\| Bitcoin Core/Knots prior to 0.20.0
	\|bgcolor=yellow\| DoS		\|bgcolor=yellow\| DoS
	\|bgcolor=yellow\| Recipient<ref name="Recipient">Can only be exploited by the recipient the victim intends to pay</ref>		\|bgcolor=yellow\| Recipient<ref name="Recipient">Can only be exploited by the recipient the victim intends to pay</ref>
Line 443:		Line 443:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-unbounded-banlist/ CVE-2020-14198]		\| [https://bitcoincore.org/en/2024/07/03/disclose-unbounded-banlist/ CVE-2020-14198]
	\|		\|
	\| Bitcoin Core 0.20.0		\| Bitcoin Core 0.20.1
	\|bgcolor=yellow\| DoS<ref name="DoS"/>		\|bgcolor=yellow\| DoS<ref name="DoS"/>
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
Line 451:		Line 451:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.20.1		\| Bitcoin Core/Knots prior to 0.20.2
	\|bgcolor=pink\| Netsplit<ref name="Netsplit"/>		\|bgcolor=pink\| Netsplit<ref name="Netsplit"/>
	\|bgcolor=yellow\| Varies		\|bgcolor=yellow\| Varies

Luke-jr: Add 2024/07/03/disclose-bip70-crash (needs CVE)

2024-07-04T03:34:02Z

Add 2024/07/03/disclose-bip70-crash (needs CVE)

← Older revision		Revision as of 03:34, 4 July 2024
Line 404:		Line 404:
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
	\| Infinite loop via p2p		\| Infinite loop via p2p
			\|-
			\| [https://bitcoincore.org/en/2024/07/03/disclose-bip70-crash/ TBD]
			\| 2024-07-03
			\| Bitcoin Core/Knots prior to 0.19.2
			\|bgcolor=yellow\| DoS
			\|bgcolor=yellow\| Recipient<ref name="Recipient">Can only be exploited by the recipient the victim intends to pay</ref>
			\| OOM via malicious BIP72 URI
	\|-		\|-
	\| [[#CVE-2020-14199\|CVE-2020-14199]]		\| [[#CVE-2020-14199\|CVE-2020-14199]]

Luke-jr: Add 2024/07/03/disclose-getdata-cpu (needs CVE)

2024-07-04T03:29:24Z

Add 2024/07/03/disclose-getdata-cpu (needs CVE)

← Older revision		Revision as of 03:29, 4 July 2024
Line 397:		Line 397:
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
	\| Network buffer OOM		\| Network buffer OOM
			\|-
			\| [https://bitcoincore.org/en/2024/07/03/disclose-getdata-cpu/ TBD]
			\| 2024-07-03
			\| Bitcoin Core/Knots prior to 0.19.2
			\|bgcolor=lime\| CPU usage
			\|bgcolor=pink\| Easy
			\| Infinite loop via p2p
	\|-		\|-
	\| [[#CVE-2020-14199\|CVE-2020-14199]]		\| [[#CVE-2020-14199\|CVE-2020-14199]]

Luke-jr: Add 2024/07/03/disclose-header-spam (needs CVE)

2024-07-04T03:25:17Z

Add 2024/07/03/disclose-header-spam (needs CVE)

← Older revision		Revision as of 03:25, 4 July 2024
Line 315:		Line 315:
	\| Alert memory exhaustion		\| Alert memory exhaustion
	\|bgcolor=lime\| [http://luke.dashjr.org/programs/bitcoin/files/charts/security.html?201610724 99%]		\|bgcolor=lime\| [http://luke.dashjr.org/programs/bitcoin/files/charts/security.html?201610724 99%]
			\|-
			\| [https://bitcoincore.org/en/2024/07/03/disclose-header-spam/ TBD]
			\| 2024-07-03
			\| Bitcoin Core/Knots prior to 0.14.3
			\|bgcolor=yellow\| DoS<ref name="DoS"/>
			\|bgcolor=lime\| Easy
			\| OOM via fake block headers
	\|-		\|-
	\| [https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html CVE-2016-10725]		\| [https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html CVE-2016-10725]

Luke-jr: Add 2024/07/03/disclose-inv-buffer-blowup (needs CVE)

2024-07-04T03:22:20Z

Add 2024/07/03/disclose-inv-buffer-blowup (needs CVE)

← Older revision		Revision as of 03:22, 4 July 2024
Line 383:		Line 383:
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
	\| Missing check of channel funding UTXO		\| Missing check of channel funding UTXO
			\|-
			\| [https://bitcoincore.org/en/2024/07/03/disclose-inv-buffer-blowup/ TBD]
			\| 2024-07-03
			\| Bitcoin Core/Knots prior to 0.19.2
			\|bgcolor=yellow\| DoS
			\|bgcolor=pink\| Easy
			\| Network buffer OOM
	\|-		\|-
	\| [[#CVE-2020-14199\|CVE-2020-14199]]		\| [[#CVE-2020-14199\|CVE-2020-14199]]

Luke-jr at 03:17, 4 July 2024

2024-07-04T03:17:42Z

← Older revision		Revision as of 03:17, 4 July 2024
Line 423:		Line 423:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.21.0		\| Bitcoin Core/Knots prior to 0.20.1
	\|bgcolor=pink\| Netsplit<ref name="Netsplit"/>		\|bgcolor=pink\| Netsplit<ref name="Netsplit"/>
	\|bgcolor=yellow\| Varies		\|bgcolor=yellow\| Varies

Luke-jr: Description for 2024/07/03/disclose-orphan-dos

2024-07-04T03:16:56Z

Description for 2024/07/03/disclose-orphan-dos

← Older revision		Revision as of 03:16, 4 July 2024
Line 358:		Line 358:
	\| [https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/ TBD]		\| [https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos/ TBD]
	\| 2024-07-03		\| 2024-07-03
	\| Bitcoin Core/Knots prior to 0.18.0		\| Bitcoin Core/Knots prior to 0.17.2
	\|bgcolor=yellow\| DoS		\|bgcolor=yellow\| DoS
	\|bgcolor=pink\| Easy		\|bgcolor=pink\| Easy
			\| Orphan transaction CPU tieup
	\|-		\|-
	\| [https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html CVE-2019-12998]		\| [https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-September/002174.html CVE-2019-12998]