CVE-2022-35253: Denial of Service in Hyperledger Fabric
Summary
CVE-2022-3525: Deserialization of Untrusted Data in librenms/librenms. Affects librenms/librenms versions < 22.10.0. Fixed in 22.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hyperledger Fabric is an open-source blockchain platform that provides a modular architecture for developing enterprise-grade blockchain applications. It is implemented in Go and offers features such as permissioned networks, smart contracts, and consensus mechanisms. However, versions prior to 2.4 of Hyperledger Fabric are vulnerable to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability in Hyperledger Fabric < 2.4 allows an attacker to exploit a non-validated request, leading to a DoS attack. The peer gateway service, responsible for extracting channel and chaincode information from signed proposals, does not validate the proposal fields. As a result, a maliciously crafted proposal can crash the peer service. This vulnerability has been addressed in version 2.4.6 of Hyperledger Fabric.
How To Fix
Minimum fixed version
22.10.0
This is the first release that contains the fix.
composer require librenms/librenms:22.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Hyperledger Fabric < 2.4 exposes the network to a Denial of Service attack. To mitigate this vulnerability, it is crucial to upgrade to version 2.4.6 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for librenms/librenms →
FAQ
Hyperledger Fabric is an open-source blockchain platform for developing enterprise-grade blockchain applications.
A Denial of Service attack is a malicious attempt to disrupt the normal functioning of a network or system, rendering it unavailable to users.
The vulnerability allows an attacker to launch a DoS attack, potentially causing disruption to the Hyperledger Fabric network and applications running on it.
Yes, the vulnerability has been patched in version 2.4.6 of Hyperledger Fabric.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for librenms/librenms.
