Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/hyperledger/fabric >= 1.0.0-alpha, < 2.2.14; >= 2.3.0, < 2.5.5
Fixed in
2.5.52.2.14· Vendor fix available
Issue
Short summary Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and…
Recommended action: Upgrade to 2.5.5 or 2.2.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hyperledger/fabric >= 2.4.0, < 2.4.6
Fixed in
2.4.6· Vendor fix available
Issue
Impact If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. This fix checks for the malformed gateway request and returns an error to the gateway client. Patches Fixed in v2.4.6. Workarounds None, users must upgrade to v2.4.6. References https://github.com/hyperledger/fabric/releases/tag/v2.4.6 For more information If you have any questions or comments about this advisory: Open an issue in Fabric Credits Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.
Recommended action: Upgrade to 2.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability exists in Hyperledger Fabric < 2.4 could allow an attacker to construct a non-validated request that could cause a denial of service attack. The peer gateway service tries to extract channel and chaincode information from the signed proposal, but it doesn't check the proposal fields for validity. Therefore a malformed proposal might end up crashing the peer service. This issue has been patched in 2.4.6. There are no known workarounds.
Recommended action: Upgrade to 2.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hyperledger/fabric < 2.2.7; >= 2.3.0, < 2.4.5
Fixed in
2.4.52.2.7· Vendor fix available
Issue
Impact If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client. Specific Go Packages Affected github.com/hyperledger/fabric/orderer/common/cluster Patches Fixed in v2.2.7 and v2.4.5. Workarounds None, users must upgrade to v2.2.7 or v2.4.5. References https://github.com/hyperledger/fabric/releases/tag/v2.2.7 https://github.com/hyperledger/fabric/releases/tag/v2.4.5 For more information If you have any questions or comments about this advisory: Open an issue in Hyperledger Fabric repository Credits Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.
Recommended action: Upgrade to 2.4.5 or 2.2.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/hyperledger/fabric >= 2.3.0, < 2.3.3; < 2.2.4
Fixed in
2.2.42.3.3· Vendor fix available
Issue
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Recommended action: Upgrade to 2.3.3 or 2.2.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Recommended action: Upgrade to 2.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.