diff --git a/data/osv/GO-2024-3189.json b/data/osv/GO-2024-3189.json new file mode 100644 index 00000000..6037dda0 --- /dev/null +++ b/data/osv/GO-2024-3189.json @@ -0,0 +1,94 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3189", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-38365", + "GHSA-27vh-h6mc-q6g8" + ], + "summary": "Consensus failure in github.com/btcsuite/btcd", + "details": "The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split (accepting an invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An attacker can trigger this vulnerability by constructing a 'standard' Bitcoin transaction that exhibits different behaviors in 'FindAndDelete()' and 'removeOpcodeByData()'.", + "affected": [ + { + "package": { + "name": "github.com/btcsuite/btcd", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/btcsuite/btcd/txscript", + "symbols": [ + "Engine.Execute", + "Engine.Step", + "VerifyTaprootKeySpend", + "baseSegwitSigVerifier.Verify", + "baseSigVerifier.Verify", + "baseTapscriptSigVerifier.Verify", + "opcodeCheckMultiSig", + "opcodeCheckSig", + "opcodeCheckSigAdd", + "opcodeCodeSeparator", + "removeOpcodeByData", + "taprootSigVerifier.Verify" + ] + } + ], + "custom_ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0.10.0" + }, + { + "fixed": "0.24.2-beta.rc1" + } + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8" + }, + { + "type": "FIX", + "url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5" + }, + { + "type": "WEB", + "url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184" + }, + { + "type": "WEB", + "url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2" + } + ], + "credits": [ + { + "name": "darosior" + }, + { + "name": "dergoegge" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3189", + "review_status": "REVIEWED" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-3189.yaml b/data/reports/GO-2024-3189.yaml new file mode 100644 index 00000000..ba08167d --- /dev/null +++ b/data/reports/GO-2024-3189.yaml @@ -0,0 +1,48 @@ +id: GO-2024-3189 +modules: + - module: github.com/btcsuite/btcd + non_go_versions: + - introduced: 0.10.0 + - fixed: 0.24.2-beta.rc1 + vulnerable_at: 0.24.0 + packages: + - package: github.com/btcsuite/btcd/txscript + symbols: + - opcodeCheckMultiSig + - taprootSigVerifier.Verify + - opcodeCodeSeparator + - baseSegwitSigVerifier.Verify + - baseSigVerifier.Verify + - removeOpcodeByData + - opcodeCheckSig + - VerifyTaprootKeySpend + - opcodeCheckSigAdd + - baseTapscriptSigVerifier.Verify + derived_symbols: + - Engine.Execute + - Engine.Step +summary: Consensus failure in github.com/btcsuite/btcd +description: |- + The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement + Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the + validation of Bitcoin blocks. This can lead to a chain split (accepting an + invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An + attacker can trigger this vulnerability by constructing a 'standard' Bitcoin + transaction that exhibits different behaviors in 'FindAndDelete()' and + 'removeOpcodeByData()'. +cves: + - CVE-2024-38365 +ghsas: + - GHSA-27vh-h6mc-q6g8 +credits: + - darosior + - dergoegge +references: + - advisory: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8 + - fix: https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5 + - web: https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 + - web: https://github.com/btcsuite/btcd/releases/tag/v0.24.2 +source: + id: GHSA-27vh-h6mc-q6g8 + created: 2024-10-14T16:05:08.379064-04:00 +review_status: REVIEWED