Vulnerability · Published Jun 11, 2020 · Assigned by GitHub_M

CVE-2020-11090Uncontrolled Resource Consumption in Indy Node

High 7.5

In plain English

A high-severity uncontrolled resource consumption in Indy Node from Hyperledger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.2%top 17.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	indy-node	1.12.3	GHSA-3gw4-m5w7-v89c
PyPI	indy-node	1.12.3	PYSEC-2020-47

Affected products (as reported)

Vendor	Product	Versions
Hyperledger	Indy Node	= 1.12.2

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c x_refsource_CONFIRM
https://pypi.org/project/indy-node/1.12.3/ x_refsource_MISC
https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1123 x_refsource_MISC