bitcoin-dev

Combined summary - Public disclosure of 10 vulnerabilities affecting Bitcoin Core < 0.21.0

Combined summary - Public disclosure of 10 vulnerabilities affecting Bitcoin Core < 0.21.0

The correspondence among the individuals named Antoine revolves around enhancing the security advisory practices for a software project.

The initiative to retroactively request CVE (Common Vulnerabilities and Exposures) numbers for historical issues from Mitre is mentioned as an underway effort. This approach aims at systematically cataloging past vulnerabilities to better manage and mitigate risks associated with software regressions. The suggestion to assign unique numeric identifiers to each security advisory, as demonstrated by OpenSSH's recent actions, is highlighted as a beneficial strategy. Such identifiers not only facilitate a methodical review of old vulnerabilities when evaluating new changes but also simplify the coordination among security researchers and handlers in developing and deploying mitigation patches.

Additionally, the gradual adoption of a new vulnerability disclosure policy by the project is discussed. The policy, along with the ten security advisories, is accessible on the project's website (Bitcoin Core Security Advisories). Plans are outlined to follow up with public disclosures of vulnerabilities addressed in successive versions of the software, starting with version 22.0 in July, followed by version 23.0 in August, and continuing with subsequent versions until all vulnerabilities in old unmaintained versions have been disclosed. This structured approach to vulnerability disclosure is posited as a measure that will be consistently applied to new software versions moving forward, marking a significant step in the project's commitment to security transparency and improvement.

Discussion History

0
Antoine PoinsotOriginal Post
July 3, 2024 16:34 UTC
1
July 3, 2024 17:12 UTC
2
July 10, 2024 07:40 UTC