data/reports: add GO-2024-3189

- data/reports/GO-2024-3189.yaml Fixes #3189 Change-Id: Ib9106c17067bbf85003b7f857bafccdf1b280d3f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/620355 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Maceo Thompson <[email protected]> Reviewed-by: Tatiana Bradley <[email protected]>
golang · Oct 15, 2024 · ebbdcbc · ebbdcbc
1 parent 18bd3a1
commit ebbdcbc
Show file tree

Hide file tree

Showing 2 changed files with 142 additions and 0 deletions.
diff --git a/data/osv/GO-2024-3189.json b/data/osv/GO-2024-3189.json
@@ -0,0 +1,94 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-3189",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-38365",
+    "GHSA-27vh-h6mc-q6g8"
+  ],
+  "summary": "Consensus failure in github.com/btcsuite/btcd",
+  "details": "The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the validation of Bitcoin blocks. This can lead to a chain split (accepting an invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An attacker can trigger this vulnerability by constructing a 'standard' Bitcoin transaction that exhibits different behaviors in 'FindAndDelete()' and 'removeOpcodeByData()'.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/btcsuite/btcd",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/btcsuite/btcd/txscript",
+            "symbols": [
+              "Engine.Execute",
+              "Engine.Step",
+              "VerifyTaprootKeySpend",
+              "baseSegwitSigVerifier.Verify",
+              "baseSigVerifier.Verify",
+              "baseTapscriptSigVerifier.Verify",
+              "opcodeCheckMultiSig",
+              "opcodeCheckSig",
+              "opcodeCheckSigAdd",
+              "opcodeCodeSeparator",
+              "removeOpcodeByData",
+              "taprootSigVerifier.Verify"
+            ]
+          }
+        ],
+        "custom_ranges": [
+          {
+            "type": "ECOSYSTEM",
+            "events": [
+              {
+                "introduced": "0.10.0"
+              },
+              {
+                "fixed": "0.24.2-beta.rc1"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5"
+    },
+    {
+      "type": "WEB",
+      "url": "https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/btcsuite/btcd/releases/tag/v0.24.2"
+    }
+  ],
+  "credits": [
+    {
+      "name": "darosior"
+    },
+    {
+      "name": "dergoegge"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-3189",
+    "review_status": "REVIEWED"
+  }
+}
diff --git a/data/reports/GO-2024-3189.yaml b/data/reports/GO-2024-3189.yaml
@@ -0,0 +1,48 @@
+id: GO-2024-3189
+modules:
+    - module: github.com/btcsuite/btcd
+      non_go_versions:
+        - introduced: 0.10.0
+        - fixed: 0.24.2-beta.rc1
+      vulnerable_at: 0.24.0
+      packages:
+        - package: github.com/btcsuite/btcd/txscript
+          symbols:
+            - opcodeCheckMultiSig
+            - taprootSigVerifier.Verify
+            - opcodeCodeSeparator
+            - baseSegwitSigVerifier.Verify
+            - baseSigVerifier.Verify
+            - removeOpcodeByData
+            - opcodeCheckSig
+            - VerifyTaprootKeySpend
+            - opcodeCheckSigAdd
+            - baseTapscriptSigVerifier.Verify
+          derived_symbols:
+            - Engine.Execute
+            - Engine.Step
+summary: Consensus failure in github.com/btcsuite/btcd
+description: |-
+    The btcd Bitcoin client (versions 0.10 to 0.24) did not correctly re-implement
+    Bitcoin Core's 'FindAndDelete()' functionality, causing discrepancies in the
+    validation of Bitcoin blocks. This can lead to a chain split (accepting an
+    invalid block) or Denial of Service (DoS) attacks (rejecting a valid block). An
+    attacker can trigger this vulnerability by constructing a 'standard' Bitcoin
+    transaction that exhibits different behaviors in 'FindAndDelete()' and
+    'removeOpcodeByData()'.
+cves:
+    - CVE-2024-38365
+ghsas:
+    - GHSA-27vh-h6mc-q6g8
+credits:
+    - darosior
+    - dergoegge
+references:
+    - advisory: https://github.com/btcsuite/btcd/security/advisories/GHSA-27vh-h6mc-q6g8
+    - fix: https://github.com/btcsuite/btcd/commit/04469e600e7d4a58881e2e5447d19024e49800f5
+    - web: https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184
+    - web: https://github.com/btcsuite/btcd/releases/tag/v0.24.2
+source:
+    id: GHSA-27vh-h6mc-q6g8
+    created: 2024-10-14T16:05:08.379064-04:00
+review_status: REVIEWED