github-actions[bot]
commented
2 months ago Coverage from tests in ./e2e_test/... for ./consensus/istanbul/... at commit b75d95367dea90bb04f472de02a6ab6159fa2be7
coverage: 46.9% of statements across all listed packages
coverage: 57.2% of statements in consensus/istanbul coverage: 23.7% of statements in consensus/istanbul/announce coverage: 54.4% of statements in consensus/istanbul/backend coverage: 0.0% of statements in consensus/istanbul/backend/backendtest coverage: 24.3% of statements in consensus/istanbul/backend/internal/replica coverage: 65.1% of statements in consensus/istanbul/core coverage: 45.0% of statements in consensus/istanbul/db coverage: 0.0% of statements in consensus/istanbul/proxy coverage: 64.2% of statements in consensus/istanbul/uptime coverage: 51.8% of statements in consensus/istanbul/validator coverage: 79.2% of statements in consensus/istanbul/validator/random
This PR contains the following updates:
v0.23.2->v0.24.0GitHub Vulnerability Alerts
CVE-2024-34478
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
btcd susceptible to consensus failures
CVE-2024-34478 / GHSA-3jgf-r68h-xfqm / GO-2024-2818
More information
#### Details btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds. #### Severity Moderate #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-34478](https://nvd.nist.gov/vuln/detail/CVE-2024-34478) - [https://github.com/btcsuite/btcd/pull/1981](https://togithub.com/btcsuite/btcd/pull/1981) - [https://github.com/btcsuite/btcd/commit/253b688c68b89eca7eb75d4d5443dbdbc928db3c](https://togithub.com/btcsuite/btcd/commit/253b688c68b89eca7eb75d4d5443dbdbc928db3c) - [https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455](https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455) - [https://github.com/btcsuite/btcd](https://togithub.com/btcsuite/btcd) - [https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3](https://togithub.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3) - [https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3](https://togithub.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3jgf-r68h-xfqm) and the [GitHub Advisory Database](https://togithub.com/github/advisory-database) ([CC-BY 4.0](https://togithub.com/github/advisory-database/blob/main/LICENSE.md)).Consensus failures in github.com/btcsuite/btcd
CVE-2024-34478 / GHSA-3jgf-r68h-xfqm / GO-2024-2818
More information
#### Details Incorrect implementation of the consensus rules outlined in BIP 68 and BIP 112 making btcd susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds. #### Severity Unknown #### References - [https://nvd.nist.gov/vuln/detail/CVE-2024-34478](https://nvd.nist.gov/vuln/detail/CVE-2024-34478) - [https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455](https://delvingbitcoin.org/t/disclosure-btcd-consensus-bugs-due-to-usage-of-signed-transaction-version/455) - [https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3](https://togithub.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/blockchain/chain.go#L383C1-L392C3) - [https://github.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3](https://togithub.com/btcsuite/btcd/blob/e4c88c3a3ecb1813529bf3dddc7a865bd418a6b8/txscript/opcode.go#L1172C1-L1178C3) - [https://github.com/btcsuite/btcd/pull/1981](https://togithub.com/btcsuite/btcd/pull/1981) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2024-2818) and the [Go Vulnerability Database](https://togithub.com/golang/vulndb) ([CC-BY 4.0](https://togithub.com/golang/vulndb#license)).Release Notes
btcsuite/btcd (github.com/btcsuite/btcd)
### [`v0.24.0`](https://togithub.com/btcsuite/btcd/releases/tag/v0.24.0): btcd v0.24.0 [Compare Source](https://togithub.com/btcsuite/btcd/compare/v0.23.4...v0.24.0) This release is a major release that includes several general bug fixes, **security bug fixes** (please update!), and also a series of performance improvements that dramatically reduce the time for initial block download from ~45 hours+ to around 6 hours! With this release,`btcd` now also supports BIP 155 and has gained support for pruning (`--prune=MiB`). ### Verifying the Release In order to verify the release, you'll need to have `gpg` or `gpg2` installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already: curl https://raw.githubusercontent.com/lightningnetwork/lnd/master/scripts/keys/roasbeef.asc | gpg --import Once you have the required PGP keys, you can verify the release (assuming `manifest-roasbeef-v0.24.0.sig` and `manifest-v0.24.0.txt` are in the current directory) with: gpg --verify manifest-roasbeef-v0.24.0.sig manifest-v0.24.0.txt You should see the following if the verification was successful: gpg: Signature made Sat Dec 30 17:11:22 2023 PST gpg: using RSA key 60A1FA7DA5BFF08BDCBBE7903BBD59E99B280306 gpg: Good signature from "Olaoluwa OsuntokunConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.