CVE-2020-26896

Katalog CVE

CVSS 8.2 · High EPSS 0,74%

Kerentanan Improper Validation of Integrity Check Value pada lightning network daemon project lightning network daemon. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collision with an invoice, the preimage for an expected payment was instead released. A malicious peer could have deliberately intercepted an HTLC intended for the victim node, probed the preimage through a colluding relayed HTLC, and stolen the intercepted HTLC. The impact is a loss of funds in certain situations, and a weakening of the victim's receiver privacy.

Rincian

Terbit di NVD

21 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002857.html mailing list · patch · advisory pihak ketiga
• https://gist.github.com/ariard/6bdeb995565d1cc292753e1ee4ae402d advisory pihak ketiga
• https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-October/002855.html mailing list · advisory pihak ketiga