HIGH7.5

GHSA-j96p-r523-8r3w

HTTP Request Smuggling in github.com/hyperledger/fabric

Quick fix

GHSA-j96p-r523-8r3w — github.com/hyperledger/fabric: upgrade to the fixed version with the command below.

go get github.com/hyperledger/fabric@v2.4.0

Details

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hyperledger/fabric

Introduced in: 0Fixed in: 2.4.0

Fixgo get github.com/hyperledger/fabric@v2.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43669[ADVISORY]
https://github.com/hyperledger/fabric/pull/2828[WEB]
https://github.com/hyperledger/fabric[PACKAGE]
https://github.com/hyperledger/fabric/releases/tag/v2.4.0-beta[WEB]
https://jira.hyperledger.org/browse/FAB-18528[WEB]