HIGH7.5

GHSA-vjj6-5m9f-wqjw

NULL Pointer Dereference in HyperLedger Fabric

Quick fix

GHSA-vjj6-5m9f-wqjw — github.com/hyperledger/fabric: upgrade to the fixed version with the command below.

go get github.com/hyperledger/fabric@v2.3.3

Details

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hyperledger/fabric

Introduced in: 2.3.0Fixed in: 2.3.3

Fixgo get github.com/hyperledger/fabric@v2.3.3

Go/github.com/hyperledger/fabric

Introduced in: 0Fixed in: 2.2.4

Fixgo get github.com/hyperledger/fabric@v2.2.4

References

https://nvd.nist.gov/vuln/detail/CVE-2021-43667[ADVISORY]
https://github.com/hyperledger/fabric/pull/2838/commits/ebf94b10ecc86d3a91619b98befc52277b1e3474[WEB]
https://github.com/hyperledger/fabric/pull/2844[WEB]
https://jira.hyperledger.org/browse/FAB-18529[WEB]
github.com/hyperledger/fabric[PACKAGE]