ARCHIVE/xrpl-dev-portal
1
0
Fork 0
mirror of https://github.com/XRPLF/xrpl-dev-portal.git synced 2025-11-17 10:15:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

include link to fix and update incident response timeline

Browse Source
This commit is contained in:
Oliver Eggert
2025-09-29 12:52:26 -07:00
parent 3c6775116b
commit 14a67f9d52
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
blog/2025/vulnerabilitydisclosurereport-bug-sep2025.md
View File

@@ -1,6 +1,6 @@
---
category: 2025
date: "2025-09-26"
date: "2025-09-29"
template: '../../@theme/templates/blogpost'
seo:
description: This vulnerability disclosure report contains technical details of the XRP Ledger bug reported on September 15, 2025.
@@ -98,7 +98,7 @@ If you sign online (via RPC), the invalid signature will be caught early and rej
## Fixes / Patches Available
We’ve proposed a fix which is under careful review and testing.
The fix for this issue is available on devnet in an updated version of the feature amendment: `PermissionDelegationV1_1`. You can see the details of the fix [here](https://github.com/XRPLF/rippled/pull/5825). The new amendment replaces `PermissionDelegation` and `DelegateV1_1`, both of which are now deprecated.
## Acknowledgements
@@ -124,5 +124,7 @@ For more information or to report further issues, please contact the team at [bu
| Key Actions | Timestamp | Description |
|-------------|-----------|-------------|
|**Initial Discovery** | September 15th, 2025 |Alerted by tequ (a community member) about the vulnerability|
|**Mitigation Actions Taken** | September 15th, 2025 | Messaged UNL validators on Mattermost to recommend voting No for PermissionDelegation amendment; Additional UNL validators have since applied vetoes to block the amendment|
| Initial Discovery | September 15, 2025 | Alerted by tequ (a community member) about the vulnerability. |
| Mitigation Actions Taken | September 15, 2025 | Messaged UNL validators on Mattermost to recommend voting No for `PermissionDelegation` amendment; additional UNL validators have since applied vetoes to block the amendment. |
| Resolution Completed | September 29, 2025 | The vulnerability has been fixed and made available in an updated amendment: `PermissionDelegationV1_1`. |
| Report Published | January 10, 2025 | Blog published with details of new feature amendment. |