PT-2023-29865 · Unknown · Hyperledger Fabric
Yacovm
·
Publicado
2023-11-14
·
Atualizado
2024-07-18
·
CVE-2023-46132
CVSS v3.1
7.1
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
Hyperledger Fabric versions prior to 2.2.14 and 2.5.5
Description
The issue arises from the way Hyperledger Fabric hashes transactions in a block, which allows an adversary to manipulate the transactions without changing the computed hash of the block. This can lead to a peer parsing transactions differently, resulting in a deviation of its world state from other peers. The vulnerability can be exploited to create a "cross-linked block" that alters the way peers process transactions, potentially causing a fork in the network. There are no known workarounds for this issue.
Recommendations
To resolve the issue, users are advised to upgrade to version 2.2.14 or 2.5.5, which include additional validations to detect potential cross-linking issues before processing blocks.
For versions prior to 2.2.14 and 2.5.5, consider applying the proposed patch that adds a
VerifyTransactionsAreWellFormed function to ensure the integrity of transactions in a block.
As a temporary workaround, consider implementing additional validation checks on transactions to detect any potential manipulation.Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Hyperledger Fabric