Upcoming DOS vulnerability announcements for Bitcoin Core
6 messages, 27 Jun to 7 Jul 2015. Started by Greg Maxwell.
Greg Maxwell (2), Thomas Pryds (2), Wladimir J. van der Laan, Jameson Lopp
On July 7th I will be making public details of several serious denial of service vulnerabilities which have fixed in recent versions of Bitcoin Core, including CVE-2015-3641.
I strongly recommend anyone running production nodes exposed to inbound connections from the internet upgrade to 0.10.2 as soon as possible.
Upgrading older systems, especially miners, is also important due to the BIP66 soft-fork which is about to reach enforcing status, see also: http://sourceforge.net/p/bitcoin/mailman/message/34199290/
On Sat, Jun 27, 2015 at 06:21:03AM +0000, Gregory Maxwell wrote:
Quoted text (1 line)
> http://sourceforge.net/p/bitcoin/mailman/message/34199290/
New archive link: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2015-June/008578.html
Wladimir
Den 27/06/2015 08.21 skrev "Gregory Maxwell" <gmaxwell@gmail•com>:
Quoted text (2 lines)
> I strongly recommend anyone running production nodes exposed to inbound > connections from the internet upgrade to 0.10.2 as soon as possible.
Does anybody know when/if 0.10.2 will be available on the Ubuntu PPA?
I could of course just install manually, but I like the convenience of a PPA.
According to the release notes, the 0.10.2 release only had notable changes for Windows. https://bitcoin.org/en/release/v0.10.2
It's not clear that there were any vulnerability patches in 0.10.2 itself that apply to Ubuntu.
- Jameson
On Sat, Jun 27, 2015 at 1:55 PM, Thomas Pryds <thomas@pryds•eu> wrote:
Quoted text (17 lines)
> > Den 27/06/2015 08.21 skrev "Gregory Maxwell" <gmaxwell@gmail•com>: > > > I strongly recommend anyone running production nodes exposed to inbound > > connections from the internet upgrade to 0.10.2 as soon as possible. > > Does anybody know when/if 0.10.2 will be available on the Ubuntu PPA? > > I could of course just install manually, but I like the convenience of a > PPA. > > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists•linuxfoundation•org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev > >
Den 27/06/2015 20.22 skrev "Jameson Lopp" <jameson.lopp@gmail•com>:
Quoted text (2 lines)
> > According to the release notes, the 0.10.2 release only had notable
changes for Windows. https://bitcoin.org/en/release/v0.10.2
Ah, makes sense, then, that the PPA doesn't carry 0.10.2. Thank you.
On Sat, Jun 27, 2015 at 6:21 AM, Gregory Maxwell <gmaxwell@gmail•com> wrote:
Quoted text (10 lines)
> On July 7th I will be making public details of several serious denial of > service vulnerabilities which have fixed in recent versions of Bitcoin Core, > including CVE-2015-3641. > > I strongly recommend anyone running production nodes exposed to inbound > connections from the internet upgrade to 0.10.2 as soon as possible. > > Upgrading older systems, especially miners, is also important due to the > BIP66 soft-fork which is about to reach enforcing status, see also: > http://sourceforge.net/p/bitcoin/mailman/message/34199290/
Just an update here-- I'm delaying this somewhat due to recent network turbulance and unusual attempted DOS attack activity on relayed infrastructure. I've also had some requests from other cryptocurrency implementors to use a somewhat longer horizon here.