News378: news fixups and add topic entries

Author: bitschmidty

_posts/en/newsletters/2025-10-31-newsletter.md

@@ -16,28 +16,40 @@ Bitcoin infrastructure software.
 ## News
 
 - **Disclosure of four low-severity vulnerabilities in Bitcoin Core:**
-  Antoine Poinsot recently [posted][poinsot disc] to the Bitcoin-Dev mailing list four Bitcoin Core security advisories for low severity
-  vulnerabilities that were fixed in [Bitcoin Core 30.0][]. According to the
-  [disclosure policy][disc pol], a low-severity vulnerability is disclosed two
-  weeks after the release of a major version containing the fix. The four
-  disclosed vulnerabilities are the following:
-
-  - [CVE-2025-54604][]: Disk filling from spoofed self connections. This bug
-    would allow an attacker to fill up the disk space of a victim node by faking
-    self-connections.
-
-  - [CVE-2025-54605][]: Disk filling from invalid blocks. This bug would allow
-    an attacker to fill up the disk space of a victim node by repeatedly sending
-    invalid blocks. This bug was disclosed responsibly by Niklas Goegge in May 2022 and also independently by Eugene Siegel. Eugene Siegel and Niklas Goegge merged the mitigation in July 2025.
-
-  - [CVE-2025-46597][]: Highly unlikely remote crash on 32-bit systems. This bug
-    may cause a node to crash when receiving a pathological block in a rare
-    edge case. This bug was disclosed responsibly by Pieter Wuille in April 2025. Antoine Poinsot implemented and merged the mitigation in June 2025.
-
-  - [CVE-2025-46598][]: CPU DoS from unconfirmed transaction processing. This
+  Antoine Poinsot recently [posted][poinsot disc] to the Bitcoin-Dev mailing
+  list four Bitcoin Core security advisories for low-severity vulnerabilities
+  that were fixed in Bitcoin Core 30.0. According to the [disclosure
+  policy][disc pol] (see [Newsletter #306][news306 disclosures]), a
+  low-severity vulnerability is disclosed two weeks after the release of a major
+  version containing the fix. The four disclosed vulnerabilities are the
+  following:
+
+  - [Disk filling from spoofed self connections][CVE-2025-54604]: This bug would
+    allow an attacker to fill up the disk space of a victim node by faking
+    self-connections. The vulnerability was [disclosed responsibly][topic
+    responsible disclosures] by Niklas Gögge in March 2022. Eugene Siegel and
+    Niklas Gögge merged a mitigation in July 2025.
+
+  - [Disk filling from invalid blocks][CVE-2025-54605]: This bug would allow an
+    attacker to fill up the disk space of a victim node by repeatedly sending
+    invalid blocks. This bug was disclosed responsibly by Niklas Gögge in May
+    2022 and also independently by Eugene Siegel in March 2025. Eugene Siegel
+    and Niklas Gögge merged the mitigation in July 2025.
+
+  - [Highly unlikely remote crash on 32-bit systems][CVE-2025-46597]: This bug may cause a
+    node to crash when receiving a pathological block in a rare edge case. This
+    bug was disclosed responsibly by Pieter Wuille in April 2025. Antoine
+    Poinsot implemented and merged the mitigation in June 2025.
+
+  - [CPU DoS from unconfirmed transaction processing][CVE-2025-46598]: This
     bug would cause resource exhaustion when processing an unconfirmed
-    transaction. Patches for the first three vulnerabilities have also been included
-    in [Bitcoin Core 29.1][] and later minor releases.
+    transaction. This bug was
+    reported to the mailing list by Antoine Poinsot in April 2025. Pieter
+    Wuille, Anthony Towns, and Antoine Poinsot implemented and merged the
+    mitigation in August 2025.
+
+  Patches for the first three vulnerabilities have also been
+  included in Bitcoin Core 29.1 and later minor releases.
 
 ## Selected Q&A from Bitcoin Stack Exchange
 
@@ -147,13 +159,12 @@ repo], and [BINANAs][binana repo]._
 {% include linkers/issues.md v=2 issues="29640,8400,3173,10280,5516,2006,1975" %}
 
 [poinsot disc]: https://groups.google.com/g/bitcoindev/c/sBpCgS_yGws
-[Bitcoin Core 30.0]: https://bitcoincore.org/en/releases/30.0/
 [disc pol]: https://bitcoincore.org/en/security-advisories/
+[news306 disclosures]: /en/newsletters/2024/06/07/#upcoming-disclosure-of-vulnerabilities-affecting-old-versions-of-bitcoin-core
 [CVE-2025-54604]: https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54604/
 [CVE-2025-54605]: https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-54605/
 [CVE-2025-46597]: https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46597/
 [CVE-2025-46598]: https://bitcoincore.org/en/2025/10/24/disclose-cve-2025-46598/
-[Bitcoin Core 29.1]: https://bitcoincore.org/en/releases/29.1/
 [LND 0.20.0-beta.rc1]: https://github.com/lightningnetwork/lnd/releases/tag/v0.20.0-beta.rc2
 [LND notes]: https://github.com/lightningnetwork/lnd/blob/master/docs/release-notes/release-notes-0.20.0.md
 [Eclair 0.13.1]: https://github.com/ACINQ/eclair/releases/tag/v0.13.1

_topics/en/responsible-disclosures.md

@@ -170,6 +170,22 @@ optech_mentions:
   - title: "Matt Morehouse responsibly disclosed a DoS vulnerability affecting LND"
     url: /en/newsletters/2025/07/25/#lnd-gossip-filter-dos-vulnerability
 
+  - title: "Niklas Gögge responsibly disclosed a disk filling vulnerability in Bitcoin Core"
+    url: /en/newsletters/2025/10/31/#disk-filling-from-spoofed-self-connections
+    date: 2022-03-16
+
+  - title: "Niklas Gögge responsibly disclosed a disk filling vulnerability in Bitcoin Core"
+    url: /en/newsletters/2025/10/31/#disk-filling-from-invalid-blocks
+    date: 2022-05-16
+
+  - title: "Pieter Wuille responsibly disclosed an unlikely 32-bit crash vulnerability in Bitcoin Core"
+    url: /en/newsletters/2025/10/31/#highly-unlikely-remote-crash-on-32-bit-systems
+    date: 2025-04-24
+
+  - title: "Antoine Poinsot responsibly disclosed a CPU-wasting DoS vulnerability in Bitcoin Core"
+    url: /en/newsletters/2025/10/31/#disk-filling-from-invalid-blocks
+    date: 2025-04-25
+
 ## Optional.  Same format as "primary_sources" above
 see_also:
   - title: "Common Vulnerabilities and Exposures (CVEs)"