GHSA-72x4-cq6r-jp4p
Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request
Quick fix
GHSA-72x4-cq6r-jp4p — github.com/hyperledger/fabric: upgrade to the fixed version with the command below.
go get github.com/hyperledger/fabric@v2.2.7Details
### Impact If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client.
### Specific Go Packages Affected github.com/hyperledger/fabric/orderer/common/cluster
### Patches Fixed in v2.2.7 and v2.4.5.
### Workarounds None, users must upgrade to v2.2.7 or v2.4.5.
### References https://github.com/hyperledger/fabric/releases/tag/v2.2.7 https://github.com/hyperledger/fabric/releases/tag/v2.4.5
### For more information If you have any questions or comments about this advisory: * Open an issue in [Hyperledger Fabric repository](https://github.com/hyperledger/fabric/issues)
### Credits Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.
Are you affected?
Enter the version of the package you're using.
Affected packages
0Fixed in: 2.2.7go get github.com/hyperledger/fabric@v2.2.72.3.0Fixed in: 2.4.5go get github.com/hyperledger/fabric@v2.4.5References
- https://github.com/hyperledger/fabric/security/advisories/GHSA-72x4-cq6r-jp4p[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2022-31121[ADVISORY]
- https://github.com/hyperledger/fabric/commit/0f18359493bcbd5f9f9d1a9b05adabfe5da23b06[WEB]
- https://github.com/hyperledger/fabric[PACKAGE]
- https://github.com/hyperledger/fabric/releases/tag/v2.2.7[WEB]
- https://github.com/hyperledger/fabric/releases/tag/v2.4.5[WEB]