Skip to content

Zero v23

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Jul 04:16
v23
459b8bf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Zero release 23, built from commit 459b8bf.

Changes

Security

  • zebra: ZIP-317 policy is now applied to mempool transactions before any
    expensive cryptographic verification, instead of after. This completes the
    GHSA-2p4c-3q4q-p463 mitigation: v21 banned peers that send invalid shielded
    proofs, but the node had already paid for proof verification by the time the
    ban landed. An unauthenticated peer could force full Halo2/Groth16
    verification on transactions that could never be mined. Rated high upstream,
    and specific to NU6.3/Ironwood-active nodes, which is every image we ship.
    (upstream #11053, 3b7467e)
  • zebra: zebrad-log-filter no longer executes log text as shell. It used GNU
    sed's e flag with log-line content interpolated into the executed string,
    so piping logs through the filter ran attacker-influenced text as commands.
    Not shipped or invoked by any image, but operators run it by hand against
    live logs. (upstream #11050, 196815d)

Scope note: upstream zebra v6.2.2 carries a third security fix, redacting the
Elasticsearch password from the startup config dump (#11051). It is deliberately
not carried. That code is behind the elasticsearch feature, which none of our
builds enable (FEATURES=release_max_level_info,progress-bar,prometheus), and
the fix changes a public field type, so carrying it would add a breaking
zebra-state API change with no effect on anything we ship. It arrives on the
next zebra subtree pull.

Both carries are marked [upstream-pending] and drop on the next zebra subtree
pull that reaches v6.2.1 / v6.2.2.

Source archives

One ZIP per vendored component (tracked source at the released commit):

  • zcashd-v23.zip
  • zebra-v23.zip
  • zaino-v23.zip
  • zallet-v23.zip
  • orchard-v23.zip
  • librustzcash-v23.zip
  • lightwalletd-v23.zip

Binaries

Prebuilt for linux/x86_64 (built on ubuntu-22.04, glibc 2.35+; stripped).
Telemetry disabled (no sentry/opentelemetry); getblocktemplate and
prometheus metrics included.

  • zebrad-v23-linux-x86_64 (with .sha256)

Note

The "Source code (zip)" and "Source code (tar.gz)" entries are
generated automatically by GitHub from the tag. They are not part of
the Zero release; use the assets above.

Assets 18
Loading