Update to incident: ACINQ releases Eclair security patch release; hostile nodes could exploit some of the issues
ACINQ releases Eclair v0.14.6 with security fixes; some issues could be exploited by hostile nodes
According to ACINQ, this is a patch release with security-hardening fixes, and some of the issues addressed could be exploited by hostile nodes; the vendor strongly recommends updating. A configuration parameter has also been added to control whether unconfirmed inputs may be spent during a splice (not allowed by default). The issues were responsibly disclosed by an external researcher; detailed release notes are linked in the post.
If you run an Eclair node without these fixes, update now: download the build, verify the checksums and release signature with ACINQ's key, then stop eclair, install v0.14.6 and restart — no channel closures are required, and the release is compatible with previous versions. Separately, check the new parameter for spending unconfirmed inputs during a splice in your configuration: this is disallowed by default, and you should not change it without a need. Those already running a build with these fixes need no action.
Source: github.com
Incident history
- 20 OctACINQ releases Eclair security patch release; hostile nodes could exploit some of the issues
- 27 OctACINQ releases Eclair v0.14.6 with security fixes; some issues could be exploited by hostile nodes