eclair · ACINQ / Eclair
ACINQ releases Eclair security patch release; hostile nodes could exploit some of the issues
ACINQ has published an Eclair patch release fixing a set of security issues. According to the vendor itself, some of them could be exploited by hostile nodes; the vulnerabilities were reported through responsible disclosure. Operators of Lightning nodes running Eclair are affected; the release is fully compatible with previous versions, and channels do not need to be closed.
Actions to take
Update Eclair to the version specified in the release now: stop the node, install the new build and restart it. Before installation, verify the release artifacts' signatures and checksums using the project's release key; further information and detailed release notes are at the link in the post.
Source: github.com
Incident history
- 20 OctACINQ releases Eclair security patch release; hostile nodes could exploit some of the issues
- 27 OctACINQ releases Eclair v0.14.6 with security fixes; some issues could be exploited by hostile nodes