CVE:CVE-2020-26895
CNNVD:CNNVD-202010-1121
Lightning Network Daemon（LND）是lightningnetwork团队的一个对Lightning Network节点完整实现的软件。该软件属于闪电支付网络的一个节点，实现了Lightning Network Specification Compliance协议中规定的条例，支持用于管道管理的对等协议、比特币交易、洋葱网络协议等功能。
Lightning Network Daemon 0.10-beta之前版本存在安全漏洞，该漏洞源于接受对手方的 high-S签名，并广播tx-relay无效的本地承诺HTLC事务。这可以被具有开放通道的任何对等点利用，而不考虑受害者的情况(例如，路由节点、支付接收方或支付发送方)。
solution:Upgrade lightning_network_daemon_project lightning_network_daemon to a higher version than 0.1:alpha,0.1.1:alpha,0.2:alpha,0.2.1:alpha,0.3:alpha,0.4:beta,0.4.1:beta,0.4.2:beta,0.5:beta,0.5:beta_rc1,0.5:beta_rc2,0.5.1:beta,0.5.1:beta_rc1,0.5.1:beta_rc2,0.5.1:beta_rc3,0.5.1:beta_rc4,0.5.2:beta,0.6:beta,0.6:beta_rc1,0.6:beta_rc2,0.6:beta_rc3,0.6:beta_rc4,0.6.1:beta,0.6.1:beta_rc1,0.6.1:beta_rc2,0.7.0:beta,0.7.0:beta_rc1,0.7.0:beta_rc2,0.7.0:beta_rc3,0.7.1:beta,0.7.1:beta_rc1,0.7.1:beta_rc2,0.8.0:beta,0.8.0:beta_rc1,0.8.0:beta_rc2,0.8.0:beta_rc3,0.8.1:beta,0.8.2:beta,0.8.2:beta_rc1,0.8.2:beta_rc2,0.9.0:beta,0.9.0:beta_rc1,0.9.0:beta_rc2,0.9.0:beta_rc3,0.9.0:beta_rc4,0.9.1:beta,0.9.1:beta_rc1,0.9.2:beta,0.10.0:beta_rc1,0.10.0:beta_rc2,0.10.0:beta_rc3,0.10.0:beta_rc4,0.10.0:beta_rc5,0.10.0:beta_rc6,and avoid the version 0.1:alpha,0.1.1:alpha,0.2:alpha,0.2.1:alpha,0.3:alpha,0.4:beta,0.4.1:beta,0.4.2:beta,0.5:beta,0.5:beta_rc1,0.5:beta_rc2,0.5.1:beta,0.5.1:beta_rc1,0.5.1:beta_rc2,0.5.1:beta_rc3,0.5.1:beta_rc4,0.5.2:beta,0.6:beta,0.6:beta_rc1,0.6:beta_rc2,0.6:beta_rc3,0.6:beta_rc4,0.6.1:beta,0.6.1:beta_rc1,0.6.1:beta_rc2,0.7.0:beta,0.7.0:beta_rc1,0.7.0:beta_rc2,0.7.0:beta_rc3,0.7.1:beta,0.7.1:beta_rc1,0.7.1:beta_rc2,0.8.0:beta,0.8.0:beta_rc1,0.8.0:beta_rc2,0.8.0:beta_rc3,0.8.1:beta,0.8.2:beta,0.8.2:beta_rc1,0.8.2:beta_rc2,0.9.0:beta,0.9.0:beta_rc1,0.9.0:beta_rc2,0.9.0:beta_rc3,0.9.0:beta_rc4,0.9.1:beta,0.9.1:beta_rc1,0.9.2:beta,0.10.0:beta_rc1,0.10.0:beta_rc2,0.10.0:beta_rc3,0.10.0:beta_rc4,0.10.0:beta_rc5,0.10.0:beta_rc6