CVE-2020-26895: Medium severity pytorch lightning vulnerability
Published Oct 21, 2020
·Updated
Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver, or payment-sender). The impact is a loss of funds in certain situations.
Affected Software
54 affected components
Lightning Network Daemon Project Lightning Network Daemon=0.1-alpha
Lightning Network Daemon Project Lightning Network Daemon=0.1.1-alpha
Lightning Network Daemon Project Lightning Network Daemon=0.2-alpha
Lightning Network Daemon Project Lightning Network Daemon=0.2.1-alpha
Lightning Network Daemon Project Lightning Network Daemon=0.3-alpha
Lightning Network Daemon Project Lightning Network Daemon=0.4-beta
Lightning Network Daemon Project Lightning Network Daemon=0.4.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.4.2-beta
Lightning Network Daemon Project Lightning Network Daemon=0.5-beta
Lightning Network Daemon Project Lightning Network Daemon=0.5-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.5-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.5.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.5.1-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.5.1-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.5.1-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.5.1-beta_rc4
Lightning Network Daemon Project Lightning Network Daemon=0.5.2-beta
Lightning Network Daemon Project Lightning Network Daemon=0.6-beta
Lightning Network Daemon Project Lightning Network Daemon=0.6-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.6-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.6-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.6-beta_rc4
Lightning Network Daemon Project Lightning Network Daemon=0.6.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.6.1-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.6.1-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.7.0-beta
Lightning Network Daemon Project Lightning Network Daemon=0.7.0-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.7.0-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.7.0-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.7.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.7.1-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.7.1-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.8.0-beta
Lightning Network Daemon Project Lightning Network Daemon=0.8.0-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.8.0-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.8.0-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.8.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.8.2-beta
Lightning Network Daemon Project Lightning Network Daemon=0.8.2-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.8.2-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.9.0-beta
Lightning Network Daemon Project Lightning Network Daemon=0.9.0-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.9.0-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.9.0-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.9.0-beta_rc4
Lightning Network Daemon Project Lightning Network Daemon=0.9.1-beta
Lightning Network Daemon Project Lightning Network Daemon=0.9.1-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.9.2-beta
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc1
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc2
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc3
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc4
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc5
Lightning Network Daemon Project Lightning Network Daemon=0.10.0-beta_rc6
Event History
Oct 21, 2020
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-26895?
CVE-2020-26895 is rated as moderate severity due to the potential for exploitation in certain scenarios.
2
How do I fix CVE-2020-26895?
To mitigate CVE-2020-26895, upgrade to LND version 0.10.0-beta or later.
3
What types of attacks can CVE-2020-26895 facilitate?
CVE-2020-26895 can be exploited by peers to disrupt transactions through invalid signature acceptance.
4
Which versions of the Lightning Network Daemon are affected by CVE-2020-26895?
CVE-2020-26895 affects LND versions prior to 0.10.0-beta.
5
How can I determine if I am vulnerable to CVE-2020-26895?
You can determine your vulnerability by checking if you are running any version of LND below 0.10.0-beta.