-
Notifications
You must be signed in to change notification settings - Fork 469
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042
Security advisories for bugs fixed as of Bitcoin Core 0.21.0 #1042
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I noticed that all of the advisories share the same excerpt " Public disclosure of a DoS vulnerability affecting old versions of Bitcoin Core". Should these perhaps be individualized to actually summarize the content of each advisory?
@@ -0,0 +1,46 @@ | |||
--- | |||
title: Disclosure: crash due to malicious BIP72 URI (<= version 0.19.2) | |||
name: blog-disclose-bip70-crash |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The title says BIP 72, the name says BIP 70. Which one is it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
BIP72 is in the context of BIP70. The attacker exploits the BIP70 implementation, by leveraging a BIP72 feature. I think it's correct as is.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see, thanks. The disclosure doesn’t mention BIP 70 at all except in the name, perhaps it would make sense to explain this in the body of the disclosure?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It now mentions BIP70 in the excerpt too, i think it's good enough?
- 2020-07-07 Pieter's PR is merged | ||
- 2020-08-01 Bitcoin Core 0.20.1 is released with the fix | ||
- 2021-01-14 Bitcoin Core 0.21.0 is released with the fix | ||
- 2022-04-25 The last vulnerable Bitcoin Core version (0.20.0) goes EOL |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
According to old versions of the old lifecycle table (which were used to create the new table), v0.20.0 went end-of-life on 2022-02-01. One of the two should probably be amended.
Corollary: Should the EOL always be based on the release date of the Major version three later or the target release date of the Major version three later?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
According to https://github.com/bitcoin/bitcoin/releases/tag/v23.0 and the dates at https://bitcoincore.org/bin/bitcoin-core-23.0/ 23.0 was released on April 25th. So i think the date here is correct.
Corollary: Should the EOL always be based on the release date of the Major version three later or the target release date of the Major version three later?
No strong opinion but i had assumed it's when the release 3 versions later actually get released.
8ea36c6
to
815e630
Compare
Should help catch issues like those in bitcoin-core#1042, which didn't cause the CI to fail. ```bash bundle exec jekyll server --future --drafts --unpublished --incremental --strict_front_matter ... Incremental build: enabled Generating... Error: YAML Exception reading /Users/michael/bitcoincore.org/_posts/en/posts/2024-06-10-disclose-bip70-crash.md: (<unknown>): mapping values are not allowed in this context at line 2 column 18 ------------------------------------------------ ```
815e630
to
29f1c6c
Compare
Thanks everyone for the review. Addressed all comments in the latest push. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ACK 29f1c6c
|
f703571 build: add --strict_front_matter to build invocation (fanquake) Pull request description: Should help catch issues like those in #1042, which didn't cause the CI to fail. ```bash bundle exec jekyll server --future --drafts --unpublished --incremental --strict_front_matter ... Incremental build: enabled Generating... Error: YAML Exception reading /bitcoincore.org/_posts/en/posts/2024-06-10-disclose-bip70-crash.md: (<unknown>): mapping values are not allowed in this context at line 2 column 18 ------------------------------------------------ ``` ACKs for top commit: dergoegge: utACK f703571 Tree-SHA512: f9e748ca356cac1043ce0458cd654eb041f446a10861b38d608b28c1fbb7f079bdf3bb2b9f06b0e37a962bf26d35563bf59a538deaf18ffe98b859ffb5cd6f97
Looks like the CI doesn't like |
They are not. It depends on the nature of the vulnerability. For some it's DoS, for other it's RCE or even "censorship". Nonetheless i've now added an excerpt with more details about the content for each post.
I've updated with using |
29f1c6c
to
d8bd2d6
Compare
…dy_asked_for rolling) Co-Authored-By: Pieter Wuille <pieter@wuille.net>
Co-Authored-by: Niklas Gögge <n.goeggi@gmail.com>
d8bd2d6
to
0a549fa
Compare
Alright, did one last push to:
|
Yeah i think this should be fixed now. |
ACK 0a549fa |
1 similar comment
ACK 0a549fa |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ACK 0a549fa
@darosior @fanquake @ajtowns @sipa @achow101 @dergoegge As I suggested on your gist here, I think it would be a good idea to PGP-signed the security advisories to minimize infrastructure compromise risks like the website or github.com being tampered with. Especially, github their 2FA authentication is not great. |
This publicly discloses 10 security vulnerabilities fixed in Bitcoin Core 0.21.0 or earlier versions.
These writeups result from a common effort to dig up and document past vulnerabilities with achow101 ajtowns fanquake dergoegge and sipa.