Sunday, 30 September 2018

Saturday, 29 September 2018

Friday, 28 September 2018

Bitcoin Core 0.15.2

/ in / with No comments /

Bitcoin Core installation binaries can be downloaded from bitcoincore.org and the source-code is available from the Bitcoin Core source repository.

Bitcoin Core version 0.15.2 is now available from:

https://bitcoincore.org/bin/bitcoin-core-0.15.2/

This is a new minor version release, including various bugfixes and performance improvements, as well as updated translations.

Please report bugs using the issue tracker at GitHub:

https://github.com/bitcoin/bitcoin/issues

To receive security and update notifications, please subscribe to:

https://bitcoincore.org/en/list/announcements/join/

How to Upgrade

If you are running an older version, shut it down. Wait until it has completely shut down (which might take a few minutes for older versions), then run the installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or bitcoind/bitcoin-qt (on Linux).

The first time you run version 0.15.0 or higher, your chainstate database will be converted to a new format, which will take anywhere from a few minutes to half an hour, depending on the speed of your machine.

The file format of fee_estimates.dat changed in version 0.15.0. Hence, a downgrade from version 0.15 or upgrade to version 0.15 will cause all fee estimates to be discarded.

Note that the block database format also changed in version 0.8.0 and there is no automatic upgrade code from before version 0.8 to version 0.15.0. Upgrading directly from 0.7.x and earlier without redownloading the blockchain is not supported. However, as usual, old wallet versions are still supported.

Downgrading warning

The chainstate database for this release is not compatible with previous releases, so if you run 0.15 and then decide to switch back to any older version, you will need to run the old release with the -reindex-chainstate option to rebuild the chainstate data structures in the old format.

If your node has pruning enabled, this will entail re-downloading and processing the entire blockchain.

Compatibility

Bitcoin Core is extensively tested on multiple operating systems using the Linux kernel, macOS 10.8+, and Windows Vista and later. Windows XP is not supported.

Bitcoin Core should also work on most other Unix-like systems but is not frequently tested on them.

Notable changes

Denial-of-Service vulnerability CVE-2018-17144

A denial-of-service vulnerability exploitable by miners has been discovered in Bitcoin Core versions 0.14.0 up to 0.16.2. It is recommended to upgrade any of the vulnerable versions to 0.15.2 or 0.16.3 as soon as possible.

0.15.2 Change log

Build system

Consensus

  • #14247 4b8a3f5 Fix crash bug with duplicate inputs within a transaction (TheBlueMatt, sdaftuar)

RPC

  • #11676 7af2457 contrib/init: Update openrc-run filename (Luke Dashjr)
  • #11277 7026845 Fix uninitialized URI in batch RPC requests (Russell Yanofsky)

Wallet

  • #11289 3f1db56 Wrap dumpwallet warning and note scripts aren’t dumped (MeshCollider)
  • #11289 42ea47d Add wallet backup text to import, add and dumpwallet RPCs (MeshCollider)
  • #11590 6372a75 [Wallet] always show help-line of wallet encryption calls (Jonas Schnelli)

bitcoin-tx

  • #11554 a69cc07 Sanity-check script sizes in bitcoin-tx (TheBlueMatt)

Tests

  • #11277 3a6cdd4 Add test for multiwallet batch RPC calls (Russell Yanofsky)
  • #11647 1c8c7f8 Add missing batch rpc calls to python coverage logs (Russell Yanofsky)
  • #11277 1036c43 Add missing multiwallet rpc calls to python coverage logs (Russell Yanofsky)
  • #11277 305f768 Limit AuthServiceProxyWrapper.__getattr__ wrapping (Russell Yanofsky)
  • #11277 2eea279 Make AuthServiceProxy._batch method usable (Russell Yanofsky)

Credits

Thanks to everyone who directly contributed to this release:

  • fanquake
  • Jonas Schnelli
  • Luke Dashjr
  • Matt Corallo
  • MeshCollider
  • Russell Yanofsky
  • Suhas Daftuar
  • Wladimir J. van der Laan

And to those that reported security issues:

  • awemany (for CVE-2018-17144, previously credited as “anonymous reporter”)


from Bitcoin Core https://ift.tt/2OYnrbc

Bitcoin Core 0.14.3

/ in / with No comments /

Bitcoin Core installation binaries can be downloaded from bitcoincore.org and the source-code is available from the Bitcoin Core source repository.

Bitcoin Core version 0.14.3 is now available from:

https://bitcoin.org/bin/bitcoin-core-0.14.3/

This is a new minor version release, including various bugfixes and performance improvements.

Please report bugs using the issue tracker at github:

https://github.com/bitcoin/bitcoin/issues

To receive security and update notifications, please subscribe to:

https://bitcoincore.org/en/list/announcements/join/

Compatibility

Bitcoin Core is extensively tested on multiple operating systems using the Linux kernel, macOS 10.8+, and Windows Vista and later.

Microsoft ended support for Windows XP on April 8th, 2014, No attempt is made to prevent installing or running the software on Windows XP, you can still do so at your own risk but be aware that there are known instabilities and issues. Please do not report issues about Windows XP to the issue tracker.

Bitcoin Core should also work on most other Unix-like systems but is not frequently tested on them.

Notable changes

Denial-of-Service vulnerability CVE-2018-17144 ——————————-

A denial-of-service vulnerability exploitable by miners has been discovered in Bitcoin Core versions 0.14.0 up to 0.16.2. It is recommended to upgrade any of the vulnerable versions to 0.14.3, 0.15.2 or 0.16.3 as soon as possible.

Known Bugs

Since 0.14.0 the approximate transaction fee shown in Bitcoin-Qt when using coin control and smart fee estimation does not reflect any change in target from the smart fee slider. It will only present an approximate fee calculated using the default target. The fee calculated using the correct target is still applied to the transaction and shown in the final send confirmation dialog.

0.14.3 Change log

Detailed release notes follow. This overview includes changes that affect behavior, not code moves, refactors and string updates. For convenience in locating the code changes and accompanying discussion, both the pull request and git merge commit are mentioned.

Consensus

  • #14247 52965fb Fix crash bug with duplicate inputs within a transaction (TheBlueMatt, sdaftuar)

RPC and other APIs

  • #10445 87a21d5 Fix: make CCoinsViewDbCursor::Seek work for missing keys (Pieter Wuille, Gregory Maxwell)
  • #9853 Return correct error codes in setban(), fundrawtransaction(), removeprunedfunds(), bumpfee(), blockchain.cpp (John Newbery)

P2P protocol and network code

  • #10234 d289b56 [net] listbanned RPC and QT should show correct banned subnets (John Newbery)

Build system

Miscellaneous

  • #10451 3612219 contrib/init/bitcoind.openrcconf: Don’t disable wallet by default (Luke Dashjr)
  • #10250 e23cef0 Fix some empty vector references (Pieter Wuille)
  • #10196 d28d583 PrioritiseTransaction updates the mempool tx counter (Suhas Daftuar)
  • #9497 e207342 Fix CCheckQueue IsIdle (potential) race condition and remove dangerous constructors. (Jeremy Rubin)

GUI

  • #9481 7abe7bb Give fallback fee a reasonable indent (Luke Dashjr)
  • #9481 3e4d7bf Qt/Send: Figure a decent warning colour from theme (Luke Dashjr)
  • #9481 e207342 Show more significant warning if we fall back to the default fee (Jonas Schnelli)

Wallet

  • #10308 28b8b8b Securely erase potentially sensitive keys/values (tjps)
  • #10265 ff13f59 Make sure pindex is non-null before possibly referencing in LogPrintf call. (Karl-Johan Alm)

Credits

Thanks to everyone who directly contributed to this release:

  • Cory Fields
  • CryptAxe
  • fanquake
  • Jeremy Rubin
  • John Newbery
  • Jonas Schnelli
  • Gregory Maxwell
  • Karl-Johan Alm
  • Luke Dashjr
  • MarcoFalke
  • Matt Corallo
  • Mikerah
  • Pieter Wuille
  • practicalswift
  • Suhas Daftuar
  • Thomas Snider
  • Tjps
  • Wladimir J. van der Laan

And to those that reported security issues:

  • awemany (for CVE-2018-17144, previously credited as “anonymous reporter”)


from Bitcoin Core https://ift.tt/2xNfHlO

Thursday, 27 September 2018

Wednesday, 26 September 2018

Tuesday, 25 September 2018

Monday, 24 September 2018

Sunday, 23 September 2018

Saturday, 22 September 2018

Friday, 21 September 2018

Thursday, 20 September 2018

CVE-2018-17144 Full Disclosure

/ in , / with No comments /

Full disclosure

CVE-2018-17144, a fix for which was released on September 18th in Bitcoin Core versions 0.16.3 and 0.17.0rc4, includes both a Denial of Service component and a critical inflation vulnerability. It was originally reported to several developers working on Bitcoin Core, as well as projects supporting other cryptocurrencies, including ABC and Unlimited on September 17th as a Denial of Service bug only, however we quickly determined that the issue was also an inflation vulnerability with the same root cause and fix.

In order to encourage rapid upgrades, the decision was made to immediately patch and disclose the less serious Denial of Service vulnerability, concurrently with reaching out to miners, businesses, and other affected systems while delaying publication of the full issue to give times for systems to upgrade. On September 20th a post in a public forum reported the full impact and although it was quickly retracted the claim was further circulated.

At this time we believe over half of the Bitcoin hashrate has upgraded to patched nodes. We are unaware of any attempts to exploit this vulnerability.

However, it still remains critical that affected users upgrade and apply the latest patches to ensure no possibility of large reorganizations, mining of invalid blocks, or acceptance of invalid transactions occurs.

Technical Details

In Bitcoin Core 0.14, an optimization was added (Bitcoin Core PR #9049) which avoided a costly check during initial pre-relay block validation that multiple inputs within a single transaction did not spend the same input twice which was added in 2012 (PR #443). While the UTXO-updating logic has sufficient knowledge to check that such a condition is not violated in 0.14 it only did so in a sanity check assertion and not with full error handling (it did, however, fully handle this case twice in prior to 0.8).

Thus, in Bitcoin Core 0.14.X, any attempts to double-spend a transaction output within a single transaction inside of a block will result in an assertion failure and a crash, as was originally reported.

In Bitcoin Core 0.15, as a part of a larger redesign to simplify unspent transaction output tracking and correct a resource exhaustion attack the assertion was changed subtly. Instead of asserting that the output being marked spent was previously unspent, it only asserts that it exists.

Thus, in Bitcoin Core 0.15.X, 0.16.0, 0.16.1, and 0.16.2, any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would be then able to claim the value being spent twice.

Timeline

Timeline for September 17, 2018: (all times UTC)

  • 14:57 anonymous reporter reports reports crash bug to: Pieter Wuille, Greg Maxwell, Wladimir Van Der Laan of Bitcoin Core, deadalnix of Bitcoin ABC, and sickpig of Bitcoin Unlimited.
  • 15:15 Greg Maxwell shares the original report with Cory Fields, Suhas Daftuar, Alex Morcos and Matt Corallo
  • 17:47 Matt Corallo identifies inflation bug
  • 19:15 Matt Corallo first tries to reach slushpool CEO to have a line of communication open to apply a patch quickly
  • 19:29 Greg Maxwell timestamps the hash of a test-case which demonstrates the inflation vulnerability (a47344b7dceddff6c6cc1c7e97f1588d99e6dba706011b6ccc2e615b88fe4350)
  • 20:15 John Newbery and James O’Beirne are informed of the vulnerability so they can assist in alerting companies to a pending patch for a DoS vulnerability
  • 20:30 Matt Corallo speaks with slushpool CTO and CEO and shares patch with disclosure of the Denial of Service
  • 20:48 slushpool confirmed upgraded
  • 21:08 Alert was sent to Bitcoin ABC that a patch will be posted publicly by 22:00
  • 21:30 (approx) Responded to original reporter with an acknowledgment
  • 21:57 Bitcoin Core PR 14247 published with patch and test demonstrating the Denial of Service bug
  • 21:58 Bitcoin ABC publishes their patch
  • 22:07 Advisory email with link to Bitcoin Core PR and patch goes out to Optech members, among others
  • 23:21 Bitcoin Core version 0.17.0rc4 tagged

September 18, 2018:

  • 00:24 Bitcoin Core version 0.16.3 tagged
  • 20:44 Bitcoin Core release binaries and release announcements were available
  • 21:47 Bitcointalk and reddit have public banners urging people to upgrade

September 19, 2018:

  • 14:06 The mailing list distributes an additional message urging people to upgrade by Pieter Wuille

September 20, 2018:

  • 19:50 A developer by the title earlz independently discovered and reported the vulnerability to the Bitcoin Core security contact email.


from Bitcoin Core https://ift.tt/2xrRql5

Wednesday, 19 September 2018

Tuesday, 18 September 2018

Bitcoin Core 0.16.3

/ in / with No comments /

Bitcoin Core installation binaries can be downloaded from bitcoincore.org and the source-code is available from the Bitcoin Core source repository.

Bitcoin Core version 0.16.3 is now available from:

https://bitcoincore.org/bin/bitcoin-core-0.16.3/

This is a new minor version release, with various bugfixes as well as updated translations.

Please report bugs using the issue tracker at GitHub:

https://github.com/bitcoin/bitcoin/issues

To receive security and update notifications, please subscribe to:

https://bitcoincore.org/en/list/announcements/join/

How to Upgrade

If you are running an older version, shut it down. Wait until it has completely shut down (which might take a few minutes for older versions), then run the installer (on Windows) or just copy over /Applications/Bitcoin-Qt (on Mac) or bitcoind/bitcoin-qt (on Linux).

The first time you run version 0.15.0 or newer, your chainstate database will be converted to a new format, which will take anywhere from a few minutes to half an hour, depending on the speed of your machine.

Note that the block database format also changed in version 0.8.0 and there is no automatic upgrade code from before version 0.8 to version 0.15.0 or higher. Upgrading directly from 0.7.x and earlier without re-downloading the blockchain is not supported. However, as usual, old wallet versions are still supported.

Downgrading warning

Wallets created in 0.16 and later are not compatible with versions prior to 0.16 and will not work if you try to use newly created wallets in older versions. Existing wallets that were created with older versions are not affected by this.

Compatibility

Bitcoin Core is extensively tested on multiple operating systems using the Linux kernel, macOS 10.8+, and Windows Vista and later. Windows XP is not supported.

Bitcoin Core should also work on most other Unix-like systems but is not frequently tested on them.

Notable changes

Denial-of-Service vulnerability

A denial-of-service vulnerability exploitable by miners has been discovered in Bitcoin Core versions 0.14.0 up to 0.16.2. It is recommended to upgrade any of the vulnerable versions to 0.16.3 as soon as possible.

0.16.3 change log

Consensus

  • #14249 696b936 Fix crash bug with duplicate inputs within a transaction (TheBlueMatt, sdaftuar)

RPC and other APIs

  • #13547 212ef1f Make signrawtransaction* give an error when amount is needed but missing (ajtowns)

Miscellaneous

  • #13655 1cdbea7 bitcoinconsensus: invalid flags error should be set to bitcoinconsensus_err (afk11)

Documentation

Credits

Thanks to everyone who directly contributed to this release:

  • Anthony Towns
  • Hennadii Stepanov
  • Matt Corallo
  • Suhas Daftuar
  • Thomas Kerin
  • Wladimir J. van der Laan

And to those that reported security issues:

  • beardnboobies

As well as everyone that helped translating on Transifex.



from Bitcoin Core https://ift.tt/2OvTbnU

Bitcoin Core 0.16.3 Released

/ in , / with No comments /

Bitcoin Core version 0.16.3 is now available for download with a fix for a denial-of-service vulnerability introduced in Bitcoin Core 0.14.0 and affecting all subsequent versions though to 0.16.2. We highly recommend users of all affected versions immediately upgrade to 0.16.3.

Security issue CVE-2018-17144: it was discovered that older versions of Bitcoin Core will crash if they try to process a block containing a transaction that attempts to spend the same input twice. Such blocks are invalid, so they can only be created by a miner willing to sacrifice their allowed income for creating a block of at least 12.5 BTC (about $80,000 USD as of this writing). This release eliminates the crash, allowing the software to quietly reject such invalid blocks.

For a complete list of changes, please see the release notes. If have any questions, please stop by our IRC chatroom and we’ll do our best to help you.



from Bitcoin Core https://ift.tt/2OEPjBi

Monday, 17 September 2018

Sunday, 16 September 2018

Saturday, 15 September 2018

Friday, 14 September 2018

Thursday, 13 September 2018

Wednesday, 12 September 2018

Tuesday, 11 September 2018

Monday, 10 September 2018

Sunday, 9 September 2018

Saturday, 8 September 2018

Friday, 7 September 2018

Thursday, 6 September 2018

Wednesday, 5 September 2018

Tuesday, 4 September 2018

Monday, 3 September 2018

Sunday, 2 September 2018

Saturday, 1 September 2018

Subscribe to: Posts (Atom)