Описание
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Ссылки
- PatchThird Party Advisory
- Vendor Advisory
- PatchThird Party Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:linuxfoundation:fabric:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:fabric:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:fabric:2.0.1:*:*:*:*:*:*:*
cpe:2.3:a:linuxfoundation:fabric:2.3.0:*:*:*:*:*:*:*
EPSS
Процентиль: 64%
0.00468
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-444
Связанные уязвимости
CVSS3: 7.5
github
около 4 лет назад
HTTP Request Smuggling in github.com/hyperledger/fabric
EPSS
Процентиль: 64%
0.00468
Низкий
7.5 High
CVSS3
5 Medium
CVSS2
Дефекты
CWE-444