Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8

NULL Pointer Dereference in HyperLedger Fabric

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.

Permalink: https://github.com/advisories/GHSA-vjj6-5m9f-wqjw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-vjj6-5m9f-wqjw, CVE-2021-43667
References: Repository: https://github.com/hyperledger/fabric
Blast Radius: 19.5

Affected Packages

go:github.com/hyperledger/fabric
Dependent packages: 322
Dependent repositories: 401
Downloads:
Affected Version Ranges: < 2.2.4, >= 2.3.0, < 2.3.3
Fixed in: 2.2.4, 2.3.3
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.11, 1.4.12, 2.0.0, 2.0.1, 2.1.0, 2.1.1
All unaffected versions: