Skip to content

Commit 0e8f0c8

Browse files
darosiordarosior
committed
pages: use bullet points for severity levels on security advisories page
These are part of the paragraph but appeared to be almost a new section of their own. This also reduces the scroll necessary to get to the latest published security advisories.
1 parent cbb872a commit 0e8f0c8

File tree

1 file changed

+79
-97
lines changed

1 file changed

+79
-97
lines changed

‎_posts/en/pages/2024-06-26-security-advisories.md‎

Lines changed: 79 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -19,103 +19,85 @@ All vulnerabilities should be reported to security@bitcoincore.org (see
1919
[SECURITY.md](https://github.com/bitcoin/bitcoin/blob/master/SECURITY.md) for
2020
details). When reported, a vulnerability will be assigned a severity category.
2121
We differentiate between 4 classes of vulnerabilities:
22-
23-
### Critical
24-
25-
Bugs that threaten the fundamental security and integrity of the entire Bitcoin
26-
network. These are bugs that allow for coin theft at the protocol level, the
27-
creation of coins outside of the specified issuance schedule, or permanent,
28-
network-wide chain splits.
29-
30-
<details markdown="1">
31-
32-
<summary>
33-
Examples
34-
</summary>
35-
36-
* A bug allowing inflating the money supply by spending the same transaction
37-
output twice within a block ([CVE-2018-17144](/en/2018/09/20/notice/)).
38-
* A consensus failure where nodes running older software rejected a block that
39-
newer software accepted due to an underlying database limit, causing a
40-
network-wide chain split ([BIP
41-
50](https://github.com/bitcoin/bips/blob/master/bip-0050.mediawiki)).
42-
43-
</details>
44-
45-
### High
46-
47-
Bugs with a significant impact on affected nodes or the network. These are
48-
typically exploitable remotely under default configurations and can cause
49-
widespread disruption.
50-
51-
<details markdown="1">
52-
53-
<summary>
54-
Examples
55-
</summary>
56-
57-
* A remotely triggerable crash that could take many nodes offline
58-
([CVE-2024-35202](/en/2024/10/08/disclose-blocktxn-crash/)).
59-
* A denial-of-service attack that causes a node to stall for an extended
60-
period, preventing it from processing new transactions and blocks
61-
([CVE-2024-52914](/en/2024/07/03/disclose-orphan-dos/)).
62-
* A memory exhaustion vulnerability that could be triggered remotely to crash
63-
nodes by having them store an excessive amount of block headers
64-
([CVE-2019-25220](/en/2024/09/18/disclose-headers-oom/)).
65-
66-
</details>
67-
68-
### Medium
69-
70-
Bugs that can noticeably degrade the network's or a node's performance or
71-
functionality, but are limited in their scope or exploitability. These might
72-
require special conditions to trigger, such as non-default settings, or result
73-
in service degradation rather than a complete node failure.
74-
75-
<details markdown="1">
76-
77-
<summary>
78-
Examples
79-
</summary>
80-
81-
* A potential Remote Code Execution (RCE) vulnerability on the local network
82-
that is only exploitable if a non-default feature like UPnP is enabled
83-
([CVE-2015-20111](/en/2024/07/03/disclose_upnp_rce/)).
84-
* A peer could hinder block propagation by sending mutated blocks, delaying the
85-
reception of new blocks for a node
86-
([CVE-2024-52921](/en/2024/10/08/disclose-mutated-blocks-hindering-propagation/)).
87-
* An attacker announcing a block to a node and then failing to provide it,
88-
causing the victim node to wait for up to 10 minutes before being able to
89-
fetch it from another peer
90-
([CVE-2024-52922](/en/2024/11/05/cb-stall-hindering-propagation/)).
91-
92-
</details>
93-
94-
### Low
95-
96-
Bugs that are challenging to exploit or have a minor impact on a node's
97-
operation. They might only be triggerable under non-default configurations or
98-
from the local network, and do not pose an immediate or widespread threat.
99-
100-
<details markdown="1">
101-
102-
<summary>
103-
Examples
104-
</summary>
105-
106-
* A malformed `getdata` message could cause a peer connection to enter an
107-
infinite loop, consuming CPU but not affecting the node's ability to process
108-
blocks or handle other peer connections
109-
([CVE-2024-52920](/en/2024/07/03/disclose-getdata-cpu/)).
110-
* A bug in a dependency that could crash a node, but only if a non-default
111-
feature like UPnP is enabled
112-
([CVE-2024-52917](/en/2024/07/31/disclose-upnp-oom/)).
113-
* A bug that could crash a node, but is extremely difficult to exploit
114-
([CVE-2024-52919](/en/2025/04/28/disclose-cve-2024-52919/)).
115-
116-
</details>
117-
118-
---
22+
* **Critical**: Bugs that threaten the fundamental security and integrity of the entire Bitcoin
23+
network. These are bugs that allow for coin theft at the protocol level, the
24+
creation of coins outside of the specified issuance schedule, or permanent,
25+
network-wide chain splits.
26+
<details markdown="1">
27+
28+
<summary>
29+
Examples
30+
</summary>
31+
32+
* A bug allowing inflating the money supply by spending the same transaction
33+
output twice within a block ([CVE-2018-17144](/en/2018/09/20/notice/)).
34+
* A consensus failure where nodes running older software rejected a block that
35+
newer software accepted due to an underlying database limit, causing a
36+
network-wide chain split ([BIP
37+
50](https://github.com/bitcoin/bips/blob/master/bip-0050.mediawiki)).
38+
39+
</details>
40+
* **High**: Bugs with a significant impact on affected nodes or the network. These are
41+
typically exploitable remotely under default configurations and can cause
42+
widespread disruption.
43+
<details markdown="1">
44+
45+
<summary>
46+
Examples
47+
</summary>
48+
49+
* A remotely triggerable crash that could take many nodes offline
50+
([CVE-2024-35202](/en/2024/10/08/disclose-blocktxn-crash/)).
51+
* A denial-of-service attack that causes a node to stall for an extended
52+
period, preventing it from processing new transactions and blocks
53+
([CVE-2024-52914](/en/2024/07/03/disclose-orphan-dos/)).
54+
* A memory exhaustion vulnerability that could be triggered remotely to crash
55+
nodes by having them store an excessive amount of block headers
56+
([CVE-2019-25220](/en/2024/09/18/disclose-headers-oom/)).
57+
58+
</details>
59+
* **Medium**: Bugs that can noticeably degrade the network's or a node's performance or
60+
functionality, but are limited in their scope or exploitability. These might
61+
require special conditions to trigger, such as non-default settings, or result
62+
in service degradation rather than a complete node failure.
63+
<details markdown="1">
64+
65+
<summary>
66+
Examples
67+
</summary>
68+
69+
* A potential Remote Code Execution (RCE) vulnerability on the local network
70+
that is only exploitable if a non-default feature like UPnP is enabled
71+
([CVE-2015-20111](/en/2024/07/03/disclose_upnp_rce/)).
72+
* A peer could hinder block propagation by sending mutated blocks, delaying the
73+
reception of new blocks for a node
74+
([CVE-2024-52921](/en/2024/10/08/disclose-mutated-blocks-hindering-propagation/)).
75+
* An attacker announcing a block to a node and then failing to provide it,
76+
causing the victim node to wait for up to 10 minutes before being able to
77+
fetch it from another peer
78+
([CVE-2024-52922](/en/2024/11/05/cb-stall-hindering-propagation/)).
79+
80+
</details>
81+
* **Low**: Bugs that are challenging to exploit or have a minor impact on a node's
82+
operation. They might only be triggerable under non-default configurations or
83+
from the local network, and do not pose an immediate or widespread threat.
84+
<details markdown="1">
85+
86+
<summary>
87+
Examples
88+
</summary>
89+
90+
* A malformed `getdata` message could cause a peer connection to enter an
91+
infinite loop, consuming CPU but not affecting the node's ability to process
92+
blocks or handle other peer connections
93+
([CVE-2024-52920](/en/2024/07/03/disclose-getdata-cpu/)).
94+
* A bug in a dependency that could crash a node, but only if a non-default
95+
feature like UPnP is enabled
96+
([CVE-2024-52917](/en/2024/07/31/disclose-upnp-oom/)).
97+
* A bug that could crash a node, but is extremely difficult to exploit
98+
([CVE-2024-52919](/en/2025/04/28/disclose-cve-2024-52919/)).
99+
100+
</details>
119101

120102
**Low** severity bugs will be disclosed 2 weeks after a fixed version exists on the current major release branch.
121103
A pre-announcement will be made at the same time as the release.

0 commit comments

Comments
 (0)