What is GHSA-72x4-cq6r-jp4p?

GHSA-72x4-cq6r-jp4p is a security advisory published by GitHub Security Advisories with High severity. Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request

Which CVE IDs does GHSA-72x4-cq6r-jp4p cover?

GHSA-72x4-cq6r-jp4p covers the following CVE IDs: CVE-2022-31121. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-72x4-cq6r-jp4p?

GHSA-72x4-cq6r-jp4p has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-72x4-cq6r-jp4p?

GHSA-72x4-cq6r-jp4p affects 2 products, including: go/github.com/hyperledger/fabric:\u003c 2.2.7; go/github.com/hyperledger/fabric:\u003e= 2.3.0, \u003c 2.4.5.

GHSA-72x4-cq6r-jp4pHighCVSS 7.5

Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request

Vendor

GitHub Security Advisories

Published

July 8, 2022

Last Modified

October 2, 2023

🔗 CVE IDs covered (1)

CVE-2022-31121 →

📋 Description

Impact

If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client.

Specific Go Packages Affected

github.com/hyperledger/fabric/orderer/common/cluster

Patches

Fixed in v2.2.7 and v2.4.5.

Workarounds

None, users must upgrade to v2.2.7 or v2.4.5.

References

https://github.com/hyperledger/fabric/releases/tag/v2.2.7 https://github.com/hyperledger/fabric/releases/tag/v2.4.5

For more information

If you have any questions or comments about this advisory:

Open an issue in Hyperledger Fabric repository

Credits

Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.

🎯 Affected products2

go/github.com/hyperledger/fabric:< 2.2.7
go/github.com/hyperledger/fabric:>= 2.3.0, < 2.4.5