PT-2023-29865 · Unknown · Hyperledger Fabric

Yacovm

·

Publicado

2023-11-14

·

Atualizado

2024-07-18

·

CVE-2023-46132

CVSS v3.1

7.1

Alta

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions prior to 2.2.14 and 2.5.5
Description The issue arises from the way Hyperledger Fabric hashes transactions in a block, which allows an adversary to manipulate the transactions without changing the computed hash of the block. This can lead to a peer parsing transactions differently, resulting in a deviation of its world state from other peers. The vulnerability can be exploited to create a "cross-linked block" that alters the way peers process transactions, potentially causing a fork in the network. There are no known workarounds for this issue.
Recommendations To resolve the issue, users are advised to upgrade to version 2.2.14 or 2.5.5, which include additional validations to detect potential cross-linking issues before processing blocks. For versions prior to 2.2.14 and 2.5.5, consider applying the proposed patch that adds a VerifyTransactionsAreWellFormed function to ensure the integrity of transactions in a block. As a temporary workaround, consider implementing additional validation checks on transactions to detect any potential manipulation.

Exploit

Correção

Race Condition

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

BIT-HYPERLEDGER-FABRIC-ORDERER-2023-46132
BIT-HYPERLEDGER-FABRIC-PEER-2023-46132
BIT-HYPERLEDGER-FABRIC-TOOLS-2023-46132
CVE-2023-46132
GHSA-V9W2-543F-H69M

Produtos afetados

Hyperledger Fabric