CVE-2018-17145

high-risk

Published 2020-09-10

Bitcoin Core 0.16.x before 0.16.2 and Bitcoin Knots 0.16.x before 0.16.2 allow remote denial of service via a flood of multiple transaction inv messages with random hashes, aka INVDoS. NOTE: this can also affect other cryptocurrencies, e.g., if they were forked from Bitcoin Core after 2017-11-15.

Do I need to act?

0.96% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Bcoin

Bitcoin Core

Bitcoin Knots

Btcd

Affected Vendors

Bitcoin Bitcoinknots Bcoin Btcd Project Decred Litecoin Namecoin

References (8)

Vendor Advisory https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145

Release Notes https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md

Third Party Advisory https://invdos.net

Exploit https://invdos.net/paper/CVE-2018-17145.pdf

Vendor Advisory https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures#CVE-2018-17145

Release Notes https://github.com/bitcoin/bitcoin/blob/v0.16.2/doc/release-notes.md

Third Party Advisory https://invdos.net

Exploit https://invdos.net/paper/CVE-2018-17145.pdf

/ 100

high-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 21/34 · High