CVE-2024-34478: High severity go/github.com/btcsuite/btcd vulnerability
Published May 5, 2024
·Updated
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transaction version as a signed integer when it is supposed to be treated as unsigned. There can be a chain split and loss of funds.
Affected Software
2 affected componentsFixes available
go/github.com/btcsuite/btcd<0.24.0
0.24.0
Btcd Project Btcd<0.24.0
Event History
May 5, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:15 AM
Affected Software
Advisory Published
via GitHub·03:30 AM
Frequently Asked Questions
1
What is the severity of CVE-2024-34478?
CVE-2024-34478 is classified as a high severity vulnerability due to its potential to cause consensus failures.
2
How do I fix CVE-2024-34478?
To fix CVE-2024-34478, upgrade to btcd version 0.24.0 or later.
3
What are the consequences of CVE-2024-34478?
CVE-2024-34478 may lead to chain splits and loss of funds in affected implementations.
4
Which versions of btcd are affected by CVE-2024-34478?
CVE-2024-34478 affects btcd versions prior to 0.24.0.
5
What specific rules are improperly implemented in CVE-2024-34478?
CVE-2024-34478 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112.