{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34694", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-05-07T13:53:00.131Z", "datePublished": "2024-06-14T14:31:12.465Z", "dateUpdated": "2024-08-02T02:59:21.774Z"}, "containers": {"cna": {"title": "LNbits improperly handles potential network and payment failures when using Eclair backend", "problemTypes": [{"descriptions": [{"cweId": "CWE-754", "lang": "en", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}], "affected": [{"vendor": "lnbits", "product": "lnbits", "versions": [{"version": "< 0.12.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T14:31:12.465Z"}, "descriptions": [{"lang": "en", "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"}], "source": {"advisory": "GHSA-3j4h-h3fp-vwww", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "lnbits", "product": "lnbits", "cpes": ["cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.12.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-15T20:13:48.624804Z", "id": "CVE-2024-34694", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:17:01.278Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.774Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:59:21.774Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-34694", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-15T20:13:48.624804Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"], "vendor": "lnbits", "product": "lnbits", "versions": [{"status": "affected", "version": "0", "lessThan": "0.12.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-15T20:16:56.262Z"}}], "cna": {"title": "LNbits improperly handles potential network and payment failures when using Eclair backend", "source": {"advisory": "GHSA-3j4h-h3fp-vwww", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lnbits", "product": "lnbits", "versions": [{"status": "affected", "version": "< 0.12.6"}]}], "references": [{"url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "name": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-754", "description": "CWE-754: Improper Check for Unusual or Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T14:31:12.465Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34694", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:59:21.774Z", "dateReserved": "2024-05-07T13:53:00.131Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-14T14:31:12.465Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"}, {"lang": "es", "value": "LNbits es un sistema de cuentas y billetera Lightning. Pagar facturas en Eclair que no se liquidan dentro del tiempo de espera interno (alrededor de 30 segundos) hace que el pago se considere fallido, aunque todav\u00eda pueda estar en proceso. Esta vulnerabilidad puede provocar una p\u00e9rdida total de fondos para el backend del nodo. Esta vulnerabilidad se solucion\u00f3 en 0.12.6."}], "id": "CVE-2024-34694", "lastModified": "2024-11-21T09:19:12.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-06-14T15:15:50.637", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-754"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}