CVE-2022-31006: Hyperledger indy-node Denial of Service Vulnerability
Summary
CVE-2022-31006: Hyperledger indy-node vulnerable to denial of service. Affects indy-node versions < 1.12.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Hyperledger indy-node is an open-source project that provides a distributed ledger for decentralized identity management. It is designed to enable secure and privacy-preserving interactions between entities in a network. The vulnerability identified as CVE-2022-31006 affects indy-node versions 0 to 1.12.6. This vulnerability allows an attacker to exhaust the maximum number of client connections allowed by the ledger, rendering it unusable for its intended purpose.
Vulnerability Detail
The CVE-2022-31006 vulnerability in Hyperledger indy-node allows an attacker to launch a denial of service (DoS) attack by overwhelming the ledger with abusive client connections. This attack can be executed by exploiting the trade-off between resilience and availability. While the ledger's content remains unaffected, the excessive client connections prevent legitimate users from accessing the ledger. The impact of this vulnerability is a temporary disruption of service until the attack ceases. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, network operators can follow the updated guidance provided in the indy-node repository to enhance the protection against denial of service attacks.
Conclusion
The CVE-2022-31006 vulnerability in Hyperledger indy-node exposes the ledger to a denial of service attack, temporarily rendering it unusable for legitimate users. Network operators can mitigate this vulnerability by modifying their firewall rules based on the updated guidance provided in the indy-node repository. It is crucial to strike a balance between resilience and availability to protect against abusive client connections. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for indy-node →
FAQ
The vulnerability allows an attacker to exhaust the maximum number of client connections allowed by the ledger, rendering it temporarily unusable for legitimate users. However, the ledger's content remains unaffected, and it resumes servicing valid client requests after the attack ceases.
Network operators should modify their firewall rules based on the updated guidance provided in the indy-node repository. These modifications increase the cost and complexity of mounting denial of service attacks, striking a balance between resilience and availability.
No, the vulnerability is not specific to a particular release. It affects indy-node versions 0 to 1.12.6.
The vulnerability was discovered by Mirko Mollik at TrustCerts.de, who responsibly disclosed the issue.
The mitigation for this vulnerability is not in the Hyperledger Indy code itself, but in the individual deployments of Indy. The mitigations should be applied to all deployments and are not tied to a specific release.
References
Related vulnerabilities
Recent vulnerabilities recorded for indy-node.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
