PT-2022-20544 · Hyperledger · Hyperledger Fabric

Haosheng Wang · Published 2022-07-07 · Updated 2024-07-18 · CVE-2022-31121

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions prior to 2.2.7 Hyperledger Fabric versions prior to 2.4.5

Description Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions, if a consensus client sends a malformed consensus request to an orderer, it may crash the orderer node. A fix has been added which checks for missing consensus messages and returns an error to the consensus client should the message be missing.

Recommendations To resolve the issue, upgrade to version 2.2.7 or v2.4.5. As there are no known workarounds for this issue, users must upgrade to the specified versions to mitigate the risk.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-HYPERLEDGER-FABRIC-ORDERER-2022-31121

BIT-HYPERLEDGER-FABRIC-PEER-2022-31121

BIT-HYPERLEDGER-FABRIC-TOOLS-2022-31121

CVE-2022-31121

GHSA-72X4-CQ6R-JP4P

Affected Products

Hyperledger Fabric

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31121.json · Exploit
• https://github.com/hyperledger/fabric/commit/0f18359493bcbd5f9f9d1a9b05adabfe5da23b06 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31121 · Security Note
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-orderer-2022-31121 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31121 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-tools-2022-31121 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-peer-2022-31121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-72x4-cq6r-jp4p · Vendor Advisory
• https://github.com/hyperledger/fabric · Note
• https://github.com/hyperledger/fabric/security/advisories/GHSA-72x4-cq6r-jp4p · Note
• https://github.com/hyperledger/fabric/releases/tag/v2.2.7 · Note
• https://github.com/hyperledger/fabric/releases/tag/v2.4.5 · Note
• https://t.me/cvenotify/33153 · Telegram Post
• https://t.me/cibsecurity/45770 · Telegram Post