CVE-2020-11090: Uncontrolled Resource Consumption in indy-node
Summary
CVE-2020-11090: In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Affects indy-node versions < 1.12.3. Fixed in 1.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indy Node is a package available on PyPI that is used for building distributed ledger solutions. It provides a set of tools and libraries for creating and managing a decentralized identity ecosystem. Indy Node is vulnerable to an Uncontrolled Resource Consumption issue in its TAA (Transaction Author Agreement) handling code. This vulnerability allows a malicious client to crash the current primary node by sending a malformed transaction, leading to a view change. Rapid view changes can potentially disrupt the entire network.
Vulnerability Detail
The Uncontrolled Resource Consumption vulnerability in Indy Node arises from a bug in its TAA handling code. By exploiting this vulnerability, an attacker can send a specially crafted transaction to the primary node, causing it to crash and trigger a view change. This can be done repeatedly and rapidly, potentially leading to a denial-of-service (DoS) situation where the network becomes unavailable. The vulnerability has been assigned the CVE identifier CVE-2020-11090 and has been fixed in version 1.12.3 of Indy Node.
How To Fix
Minimum fixed version
1.12.3
This is the first release that contains the fix.
pip install --upgrade "indy-node==1.12.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Indy Node as soon as possible.
Conclusion
The Uncontrolled Resource Consumption vulnerability in Indy Node can be exploited by a malicious client to crash the primary node and potentially disrupt the entire network. It is crucial to upgrade to version 1.12.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for indy-node →
FAQ
Indy Node is a package used for building distributed ledger solutions and managing decentralized identity ecosystems.
The vulnerability allows a malicious client to crash the primary node and potentially disrupt the entire network.
You can fix this vulnerability by upgrading to version 1.12.3 or later of Indy Node.
No, there is no known workaround for this vulnerability.
Yes, the vulnerability has been assigned the CVE identifier CVE-2020-11090.
References
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
