GitHub Advisoryadvisory · Go

GHSA-j96p-r523-8r3w HTTP Request Smuggling in github.com/hyperledger/fabric

HIGH Published 2021-12-03 Modified 2021-11-24 Official page ↗
Aliases
CVE-2021-43669
Ecosystem
Go
Packages
github.com/hyperledger/fabric
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-444
Reviewed
2021-11-24

Affected packages

• Go github.com/hyperledger/fabric: < 2.4.0 → fixed in 2.4.0

Description

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.

Related

Alias · CVE (1)

  • CVE-2021-43669 A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References