Critical severity · published Nov 7, 2022
CVE-2022-44797
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BT
Btcd · Btcd Project
before 0.23.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-44797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-44797
Patch
https://github.com/btcsuite/btcd/pull/1896
Release Notes
https://github.com/btcsuite/btcd/releases/tag/v0.23.2
Exploit
https://github.com/lightningnetwork/lnd/issues/7002
Release Notes
https://github.com/lightningnetwork/lnd/releases/tag/v0.15.2-beta
More from Btcd
8.1
CVE-2024-38365
btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality
7.5
CVE-2024-34478
btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures
7.5
CVE-2018-17145
Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka…
6.5
CVE-2022-39389
Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node