| Summary: | net-p2p/bitcoin*: Improper policy implementation of BIP125 (CVE-2021-31876) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sam James <sam> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | IN_PROGRESS --- | ||
| Severity: | normal | CC: | luke-jr+gentoobugs, O01eg, proxy-maint |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-May/018893.html | ||
| Whiteboard: | ?? [upstream?] | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Sam James
2021-05-15 01:21:35 UTC
It's not clear to me if this is an actual vulnerability or if it's possible for it to be fixed without great difficulty. Luke? It's arguably a bug, but definitely not a security issue in Bitcoin Core. It may be a real security issue in other software - as I understand it, some Lightning implementations and similar layer-2 software are affected. If Bitcoin Core is where the vulnerability needs to be fixed (and it's not going to be fixed elsewhere) then it needs to be handled as a vulnerability in Bitcoin Core. (In reply to John Helmert III from comment #3) > If Bitcoin Core is where the vulnerability needs to be fixed It's not and can't be. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. Package list is empty or all packages have requested keywords. I'm not sure what, if any, packages exist in Gentoo actually affected by this CVE. Only possibility I can see at a glance is net-misc/electrum, but I am not certain of it. |