Bitcoin Core has just disclosed three vulnerabilities at once. The most serious one could let any unfamiliar node that connects to yours exhaust the memory of nodes running on Windows or Mac, causing them to crash.
This is from Core’s official security advisory, published on October 28. All three vulnerabilities were first found by AI code scanning, then manually verified and fixed. They’ve been patched in versions 29.5, 30.4, 31.2, and 32.1.
If you keep your coins on an exchange, this probably doesn’t affect you much. All three vulnerabilities could make a node crash or hang; none could directly steal your coins. Those affected are people who run their own full nodes and use Core as a wallet.
The part really worth watching is the sentence later in the advisory: details of three other medium- to high-severity vulnerabilities fixed in 30.0 will also be made public in two weeks.
In the past, when Core encountered a medium-severity vulnerability, it could wait a year before disclosing it, giving everyone plenty of time to upgrade. The rules changed last week: vulnerabilities that AI can easily find will be disclosed once they’re fixed. Once the details are out, older versions that haven’t been upgraded will be sitting ducks.
One more thing to watch out for: a patch doesn’t fully fix the low-severity reorganization vulnerability on 32-bit systems or when blockchain data is stored on an old FAT32 drive. Might as well replace it while you’re at it.
If you run your own node, upgrade to the latest version in your branch today. Don’t wait until the details come out in two weeks and then scramble.
#比特币Core发现三个漏洞 $BTC
This is from Core’s official security advisory, published on October 28. All three vulnerabilities were first found by AI code scanning, then manually verified and fixed. They’ve been patched in versions 29.5, 30.4, 31.2, and 32.1.
If you keep your coins on an exchange, this probably doesn’t affect you much. All three vulnerabilities could make a node crash or hang; none could directly steal your coins. Those affected are people who run their own full nodes and use Core as a wallet.
The part really worth watching is the sentence later in the advisory: details of three other medium- to high-severity vulnerabilities fixed in 30.0 will also be made public in two weeks.
In the past, when Core encountered a medium-severity vulnerability, it could wait a year before disclosing it, giving everyone plenty of time to upgrade. The rules changed last week: vulnerabilities that AI can easily find will be disclosed once they’re fixed. Once the details are out, older versions that haven’t been upgraded will be sitting ducks.
One more thing to watch out for: a patch doesn’t fully fix the low-severity reorganization vulnerability on 32-bit systems or when blockchain data is stored on an old FAT32 drive. Might as well replace it while you’re at it.
If you run your own node, upgrade to the latest version in your branch today. Don’t wait until the details come out in two weeks and then scramble.
#比特币Core发现三个漏洞 $BTC