Detections
Analytics
SCA: security update for github.com/lightningnetwork/lnd (GHSA-hc82-w9v8-83pr)
medium Tenable Cloud Security Plugin ID 415640
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd
nodes before version `v0.15.4` are vulnerable to a block parsing bug that can cause a node to enter a
degraded state once encountered. In this degraded state, nodes can continue to make payments and forward
HTLCs, and close out channels. Opening channels is prohibited, and also on chain transaction events will
be undetected. This can cause loss of funds if a CSV expiry is researched during a breach attempt or a
CLTV delta expires forgetting the funds in the HTLC. A patch is available in `lnd` version 0.15.4. Users
are advised to upgrade. Users unable to upgrade may use the `lncli updatechanpolicy` RPC call to increase
their CLTV value to a very high amount or increase their fee policies. This will prevent nodes from
routing through your node, meaning that no pending HTLCs can be present. (CVE-2022-39389)
See Also
Plugin Details
Severity: Medium
ID: 415640
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.1
Percentile: 6.91
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P
CVSS Score Source: CVE-2022-39389
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 11/18/2022
Vulnerability Publication Date: 11/17/2022
Reference Information
CVE: CVE-2022-39389
cwe: CWE-20