Bitcoin Lightning developer ACINQ urged node operators to upgrade Eclair after fixing vulnerabilities that malicious peers could exploit. ACINQ released version 0.14.5 on Oct. 20, marking the second security-focused release within five days. Eclair runs Bitcoin Lightning nodes that manage payment channels and route transactions through the network. The developers credited researchers Nuhiat-Arefin and mptfire for responsibly reporting the problems fixed by the update.
Lightning node operators maintain payment channels funded with Bitcoin. Vulnerabilities in interactions with hostile peers pose potential security and operational risks to infrastructure supporting Lightning payments. However, ACINQ has not disclosed how the newly fixed exploits work or identified the older versions affected. The announcement reported no confirmed attacks or financial losses, and the potential financial consequences remain unclear.
The release instructions say operators can upgrade while keeping existing payment channels open. Operators must first stop Eclair, then install the updated version, and finally restart Eclair. This process avoids blockchain transactions and channel reconfiguration that closing and reopening payment channels can require.
The previous security release, version 0.14.4, arrived on Oct. 15 with more defenses against malicious nodes and a fix involving Eclair's administrative interface. Version 0.14.4 rejected API requests containing an Origin header, blocking browsers from accessing the application programming interface directly. The developers explained that browsers could automatically include cached login credentials in cross-site requests. A malicious website visited by a node operator could consequently use a basic web form to issue authenticated commands to the node.
The restriction removed that attack route while leaving normal command-line access available. However, browser-based Lightning management tools now need an intermediary backend to communicate with Eclair's API. The maintainers have not connected the vulnerabilities fixed in version 0.14.5 to the earlier browser-related problem. Operators who installed version 0.14.4 must upgrade again to receive the protections released five days later.
ACINQ has also provided signed release files and SHA-256 checksums so operators can verify downloads before installation. Installing compromised software could create additional risks for infrastructure managing Bitcoin-funded payment channels. Eclair 0.14.5 is now the latest release, requiring another installation cycle for operators seeking the newest protections. ACINQ has not published a detailed account of the vulnerabilities or an affected-version list, leaving the exposure of older deployments uncertain. Operators therefore lack a documented basis for deciding whether existing installations can safely continue operating.
Bitcoin Lightning Developers Release Second Security Patch in Five Days
CryptoSlateShare
Summary
Bitcoin news: ACINQ released Eclair 0.14.5 on Oct. 20, the second security patch in five days. The update fixes flaws that could lead to a security breach via malicious peers. Researchers Nuhiat-Arefin and mptfire reported the issues. Node operators should upgrade. The prior patch, 0.14.4, came out on Oct. 15 to block malicious nodes and browser attacks. ACINQ shared signed files and checksums but did not list affected versions or confirm attacks.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.