GitHub Advisoryadvisory · Go

GHSA-72x4-cq6r-jp4p Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request

HIGH Published 2022-07-08 Modified 2023-10-02 Official page ↗
Aliases
CVE-2022-31121
Ecosystem
Go
Packages
github.com/hyperledger/fabric
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2022-07-08

Affected packages

• Go github.com/hyperledger/fabric: < 2.2.7 → fixed in 2.2.7 • Go github.com/hyperledger/fabric: >= 2.3.0, < 2.4.5 → fixed in 2.4.5

Description

Impact If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client. Specific Go Packages Affected github.com/hyperledger/fabric/orderer/common/cluster Patches Fixed in v2.2.7 and v2.4.5. Workarounds None, users must upgrade to v2.2.7 or v2.4.5. References https://github.com/hyperledger/fabric/releases/tag/v2.2.7 https://github.com/hyperledger/fabric/releases/tag/v2.4.5 For more information If you have any questions or comments about this advisory: • Open an issue in Hyperledger Fabric repository Credits Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.

Related

Alias · CVE (1)

  • CVE-2022-31121 Hyperledger Fabric is a permissioned distributed ledger framework. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References