Vulnerability · Published Nov 18, 2021 · Assigned by mitre
CVE-2021-43669
High 7.5
In plain English
A high-severity security flaw in the github.com/hyperledger/fabric package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.1%top 33.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hyperledger/fabric | 2.4.0 | GHSA-j96p-r523-8r3w |
Affected products (as reported)
References
- https://jira.hyperledger.org/browse/FAB-18528 x_refsource_MISC
- https://github.com/hyperledger/fabric/pull/2828 x_refsource_MISC