CVE-2020-11093: Hyperledger Indy Node - Unauthorized Alterations to Ledger
Summary
CVE-2020-11093: Hyperledger Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. Affects indy-node across 2 version ranges.
< 1.12.4
< 55056f22c83b7c3520488b615e1577e0f895d75a
Fixed in 55056f22c83b7c3520488b615e1577e0f895d75a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hyperledger Indy Node is the server component of a distributed ledger designed for decentralized identity. It provides a purpose-built solution for managing identities in a decentralized manner. This vulnerability affects Hyperledger Indy Node versions prior to 1.12.4. The vulnerability allows an attacker to make unauthorized alterations to the ledger by exploiting a lack of signature verification on a specific transaction. Specifically, when updating a DID with a nym transaction, the update will be written to the ledger even if the ROLE or VERKEY fields are not being changed. This enables a malicious DID with no specific role to request an update for another DID, potentially leading to various security issues.
Vulnerability Detail
The vulnerability in Hyperledger Indy Node allows any DID to write a nym transaction to the ledger, resulting in potential spamming of the ledger. Additionally, any DID can change the alias of any other DID, leading to confusion and potential impersonation. The update transaction also modifies the ledger metadata associated with a DID, which can have unintended consequences. This vulnerability poses a risk to the integrity and security of the decentralized identity system.
How To Fix
Minimum fixed version
55056f22c83b7c3520488b615e1577e0f895d75a
This is the first release that contains the fix.
pip install --upgrade "indy-node==55056f22c83b7c3520488b615e1577e0f895d75a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in Hyperledger Indy Node allows for unauthorized alterations to the ledger, potentially leading to various security issues. It is crucial to update to the latest version of Hyperledger Indy Node to mitigate this vulnerability. For further support and assistance with vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for indy-node →
FAQ
Hyperledger Indy Node is the server component of a distributed ledger designed for decentralized identity. It provides a purpose-built solution for managing identities in a decentralized manner.
This vulnerability allows unauthorized alterations to the ledger, potentially leading to spamming of the ledger, confusion with aliases, and modification of metadata associated with DIDs.
To fix this vulnerability, it is recommended to update Hyperledger Indy Node to version 1.12.4 or later.
There are no specific workarounds mentioned for this vulnerability.
For more information about this vulnerability, you can refer to the official advisory provided by the Hyperledger Indy project.
References
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
