PT-2022-23122 · Unknown · Hyperledger Fabric

Haosheng Wang · Published 2022-08-18 · Updated 2024-07-18 · CVE-2022-36023

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions prior to 2.4.6

Description Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer, it may crash the peer node. The issue is resolved by checking for the malformed gateway request and returning an error to the gateway client.

Recommendations For versions prior to 2.4.6, upgrade to version 2.4.6 to resolve the issue. As a temporary workaround, consider restricting access to the gateway peer to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-HYPERLEDGER-FABRIC-ORDERER-2022-36023

BIT-HYPERLEDGER-FABRIC-PEER-2022-36023

BIT-HYPERLEDGER-FABRIC-TOOLS-2022-36023

CVE-2022-36023

GHSA-QJ6R-FHRC-JJ5R

Affected Products

Hyperledger Fabric

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36023.json · Exploit
• https://github.com/hyperledger/fabric/pull/3577 · Patch
• https://github.com/hyperledger/fabric/pull/3576 · Patch
• https://github.com/hyperledger/fabric/pull/3572 · Patch
• https://osv.dev/vulnerability/GHSA-qj6r-fhrc-jj5r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36023 · Security Note
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-peer-2022-36023 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-tools-2022-36023 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-orderer-2022-36023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36023 · Vendor Advisory
• https://github.com/hyperledger/fabric · Note
• https://github.com/hyperledger/fabric/security/advisories/GHSA-qj6r-fhrc-jj5r · Note
• https://github.com/hyperledger/fabric/releases/tag/v2.4.6 · Note
• https://t.me/cvenotify/39801 · Telegram Post
• https://t.me/cibsecurity/48362 · Telegram Post