VDB
Sign up
HIGH7.5

GHSA-9w7j-q3xw-p9vh

Hyperledger Fabric subject to Denial of Service via non-validated request

Quick fix

GHSA-9w7j-q3xw-p9vh — github.com/hyperledger/fabric: upgrade to the fixed version with the command below.

go get github.com/hyperledger/fabric@v2.4.6

Details

A vulnerability exists in Hyperledger Fabric < 2.4 could allow an attacker to construct a non-validated request that could cause a denial of service attack. The peer gateway service tries to extract channel and chaincode information from the signed proposal, but it doesn't check the proposal fields for validity. Therefore a malformed proposal might end up crashing the peer service. This issue has been patched in 2.4.6. There are no known workarounds.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hyperledger/fabric
Introduced in: 0Fixed in: 2.4.6
Fixgo get github.com/hyperledger/fabric@v2.4.6

References