GitHub Advisoryadvisory · PyPI

GHSA-r6v9-p59m-gj2p Indy's NODE_UPGRADE transaction vulnerable to remote code execution

HIGH Published 2022-09-02 Modified 2024-11-18 Official page ↗
Aliases
CVE-2022-31020
Ecosystem
PyPI
Packages
indy-node
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weaknesses
CWE-287
Reviewed
2022-09-02

Affected packages

• PyPI indy-node: < 1.12.5rc1 → fixed in 1.12.5rc1

Description

Impact The `pool-upgrade` request handler in Indy-Node `=1.12.5` as soon as possible. Patches The `pool-upgrade` request handler in Indy-Node `>=1.12.5` has been updated to properly authenticate `pool-upgrade` transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. Mitigations Network operators are strongly encouraged to upgrade to the latest Indy-Node release `>=1.12.5` as soon as possible. Acknowledgements Thank you to @shakreiner at CyberArk Labs for finding and responsibly disclosing this issue.

Related

Alias · CVE (1)

  • CVE-2022-31020 Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References