Is Litecoin affected by CVE-2018-17144 ?

[dgpv]

bitcoin#14247

https://nvd.nist.gov/vuln/detail/CVE-2018-17144

It seems that the code that was fixed in bitcoin in bitcoin@b8f8019 still exist in Litecoin's src/validation.cpp:3036

I did not have the time to check this myself, but as a bulk of Litecoin code is shared with bitcoin, it is very likely that the same bug exist in Litecoin.

[losh11]

Hi, we are working on a build of Litecoin 0.16.3 which fixes CVE-2018-17144. This should be gitian-signed and release within the next few hours.

…

On Wed, 19 Sep 2018 at 13:57, Dmitry Petukhov ***@***.***> wrote: bitcoin#14247 <bitcoin#14247> https://nvd.nist.gov/vuln/detail/CVE-2018-17144 It seems that the code that was fixed in bitcoin in ***@***.*** <bitcoin@b8f8019> still exist in Litecoin's src/validation.cpp:3036 I did not have the time to check this myself, but as a bulk of Litecoin code is shared with bitcoin, it is very likely that the same bug exist in Litecoin. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#537>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACfNuqtWPw2PYFUhECk7oSghp2Lqh2x4ks5ucj8mgaJpZM4WwG1Y> .

[losh11]

@dgpv 0.16.3 which implements a patch for CVE-2018-17144 has been released! If you are running Litecoin Core 0.14.0 to 0.16.2, especially so for economic nodes (exchanges, merchant processor, etc) you should update as soon as possible.

0.16.3 binaries are available on both https://litecoin.org and https://litecoin.com

[gituser]

hi.

@losh11 can you please make v0.16.3 as the latest release on github?

I'm using github api to constantly monitor updates of litecoin and it shows that latest version is v0.15.1 which is very outdated.