maxmustermann/dogecoin
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

doc: Fill in details about miniupnp CVE-2017-8798

Browse source
This commit is contained in:
Wladimir J. van der Laan 2017-06-07 13:06:11 +02:00
parent 5e408d99a2
commit 7a643511b4
No known key found for this signature in database
GPG key ID: 1E4AED62986CD25D
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
doc/release-notes.md
View file

@ -33,7 +33,17 @@ Notable changes
miniupnp CVE-2017-8798
----------------------------
[todo]
Bundled miniupnpc was updated to 2.0.20170509. This fixes an integer signedness error
(present in MiniUPnPc v1.4.20101221 through v2.0) that allows remote attackers
(within the LAN) to cause a denial of service or possibly have unspecified
other impact.
This only affects users that have explicitly enabled UPnP through the GUI
setting or through the `-upnp` option, as since the last UPnP vulnerability
(in Bitcoin Core 0.10.3) it has been disabled by default.
If you use this option, it is recommended to upgrade to this version as soon as
possible.
0.14.2 Change log
=================
@ -48,10 +58,10 @@ git merge commit are mentioned.
### P2P protocol and network code
- #10424 `37a8fc5` Populate services in GetLocalAddress (morcos)
- #10441 `9e3ad50` net: only enforce expected services for half of outgoing connections (theuni)
- #10441 `9e3ad50` Only enforce expected services for half of outgoing connections (theuni)
### Build system
- #10414 `ffb0c4b` [depends] miniupnpc 2.0.20170509 (fanquake)
- #10414 `ffb0c4b` miniupnpc 2.0.20170509 (fanquake)
- #10228 `ae479bc` Regenerate bitcoin-config.h as necessary (theuni)
### Miscellaneous