Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8

NULL Pointer Dereference in HyperLedger Fabric

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.

Permalink: https://github.com/advisories/GHSA-vjj6-5m9f-wqjw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00105
EPSS Percentile: 0.4395

Identifiers: GHSA-vjj6-5m9f-wqjw, CVE-2021-43667
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-43667
• https://github.com/hyperledger/fabric/pull/2838/commits/ebf94b10ecc86d3a91619b98befc52277b1e3474
• https://github.com/hyperledger/fabric/pull/2844
• https://jira.hyperledger.org/browse/FAB-18529
• https://github.com/advisories/GHSA-vjj6-5m9f-wqjw

Repository: https://github.com/hyperledger/fabric
Blast Radius: 19.5

Affected Packages