CVE-2022-44797: btcd mishandles witness size checking

November 7, 2022

btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.

References

github.com/advisories/GHSA-2chg-86hq-7w38
github.com/btcsuite/btcd/pull/1896
github.com/btcsuite/btcd/releases/tag/v0.23.2
github.com/lightningnetwork/lnd/issues/7002
github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta
nvd.nist.gov/vuln/detail/CVE-2022-44797

Code Behaviors & Features

Detect and mitigate CVE-2022-44797 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →