CVE-2022-36023

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6.

CVSS v3.0 5.3 MEDIUM

5.3^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/hyperledger/fabric/releases/tag/v2.4.6	Release Notes
https://github.com/hyperledger/fabric/security/advisories/GHSA-qj6r-fhrc-jj5r	Third Party Advisory
https://github.com/hyperledger/fabric/pull/3572	Patch
https://github.com/hyperledger/fabric/pull/3577	Patch
https://github.com/hyperledger/fabric/pull/3576	Patch

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:hyperledger:fabric:*:*:*:*:*:*:*:*

Information

Published : 2022-08-18 09:15

Updated : 2023-02-15 18:32

NVD link : CVE-2022-36023

Mitre link : CVE-2022-36023

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

hyperledger

fabric

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/hyperledger/fabric/releases/tag/v2.4.6", "name": "https://github.com/hyperledger/fabric/releases/tag/v2.4.6", "tags": ["Release Notes"], "refsource": "MISC"}, {"url": "https://github.com/hyperledger/fabric/security/advisories/GHSA-qj6r-fhrc-jj5r", "name": "https://github.com/hyperledger/fabric/security/advisories/GHSA-qj6r-fhrc-jj5r", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/hyperledger/fabric/pull/3572", "name": "https://github.com/hyperledger/fabric/pull/3572", "tags": ["Patch"], "refsource": "MISC"}, {"url": "https://github.com/hyperledger/fabric/pull/3577", "name": "https://github.com/hyperledger/fabric/pull/3577", "tags": ["Patch"], "refsource": "MISC"}, {"url": "https://github.com/hyperledger/fabric/pull/3576", "name": "https://github.com/hyperledger/fabric/pull/3576", "tags": ["Patch"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. If a gateway client application sends a malformed request to a gateway peer it may crash the peer node. Version 2.4.6 checks for the malformed gateway request and returns an error to the gateway client. There are no known workarounds, users must upgrade to version 2.4.6."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-36023", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}}, "publishedDate": "2022-08-18T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:hyperledger:fabric:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.4.6"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-16T02:32Z"}