GitHub Advisoryadvisory · Go

GHSA-vjj6-5m9f-wqjw NULL Pointer Dereference in HyperLedger Fabric

HIGH Published 2022-05-25 Modified 2022-05-25 Official page ↗
Aliases
CVE-2021-43667
Ecosystem
Go
Packages
github.com/hyperledger/fabric
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Reviewed
2022-05-25

Affected packages

• Go github.com/hyperledger/fabric: >= 2.3.0, < 2.3.3 → fixed in 2.3.3 • Go github.com/hyperledger/fabric: < 2.2.4 → fixed in 2.2.4

Description

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.

Related

Alias · CVE (1)

  • CVE-2021-43667 A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References