Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8
NULL Pointer Dereference in HyperLedger Fabric
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Permalink: https://github.com/advisories/GHSA-vjj6-5m9f-wqjwJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12amo2LTVtOWYtd3Fqd84AArM8
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-vjj6-5m9f-wqjw, CVE-2021-43667
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-43667
- https://github.com/hyperledger/fabric/pull/2838/commits/ebf94b10ecc86d3a91619b98befc52277b1e3474
- https://github.com/hyperledger/fabric/pull/2844
- https://jira.hyperledger.org/browse/FAB-18529
- https://github.com/advisories/GHSA-vjj6-5m9f-wqjw
Blast Radius: 19.5
Affected Packages
go:github.com/hyperledger/fabric
Dependent packages: 322Dependent repositories: 401
Downloads:
Affected Version Ranges: < 2.2.4, >= 2.3.0, < 2.3.3
Fixed in: 2.2.4, 2.3.3
All affected versions: 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9, 1.4.10, 1.4.11, 1.4.12, 2.0.0, 2.0.1, 2.1.0, 2.1.1
All unaffected versions: