CVE-2020-11090: Uncontrolled Resource Consumption in Indy Node
Summary
CVE-2020-11090: Uncontrolled Resource Consumption in Indy Node. Affects indy-node versions >= 1.12.2, < 1.12.3. Fixed in 1.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indy Node is an open-source project that provides a distributed ledger technology (DLT) platform for building decentralized identity solutions. It is primarily used in the Sovrin network, which aims to establish a global public utility for self-sovereign identity. Indy Node allows participants to run nodes and participate in the consensus process to maintain the integrity of the ledger. However, a vulnerability has been discovered in the TAA (Transaction Author Agreement) handling code of Indy Node, which can be exploited to crash the current primary node and potentially bring down the entire network.
Vulnerability Detail
The vulnerability arises from a bug in the TAA handling code of Indy Node. By sending a malformed transaction from a client, an attacker can trigger a view change, causing the primary node to crash. Repeated rapid view changes can lead to network instability and loss of consensus. The issue was initially observed on the Sovrin StagingNet, where write transactions failed to validate due to consensus loss. The root cause was identified as the acceptance of the malformed TAA. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.12.3
This is the first release that contains the fix.
pip install --upgrade "indy-node==1.12.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Indy Node's TAA handling code poses a significant risk to the stability and consensus of the network. It is crucial to apply the recommended fixes and upgrade all instances of Indy Node to mitigate the potential impact. For further support and assistance in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for indy-node →
FAQ
Indy Node is an open-source project that provides a distributed ledger technology (DLT) platform for building decentralized identity solutions. It is primarily used in the Sovrin network.
The vulnerability allows an attacker to crash the primary node in Indy Node, potentially leading to network instability and loss of consensus.
The vulnerability can be fixed by developing a patch for the TAA handling code in Indy Node and upgrading all instances of the software.
No specific workarounds have been provided for this vulnerability.
No, this vulnerability does not directly expose data or compromise the integrity of the ledger. However, it can disrupt the network's operation.
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
