PT-2021-23899

CVE-2021-43667

Published

2021-11-18

Updated

2022-05-25

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: HyperLedger Fabric versions 1.4.0 through 2.1.0

Description: A bug in HyperLedger Fabric allows an attacker to crash any leader node by constructing a message with a nil payload and sending it using the forwardToLeader method. The developers have acknowledged and fixed this issue.

Recommendations: For HyperLedger Fabric version 1.4.0, update to a version that includes the fix for this bug. For HyperLedger Fabric version 2.0.0, update to a version that includes the fix for this bug. For HyperLedger Fabric version 2.1.0, update to a version that includes the fix for this bug. As a temporary workaround, consider restricting the use of the forwardToLeader method until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Govulnbot

Vendors

Affected products

Weakness enumeration

CWE-476: NULL Pointer Dereference

Related identifiers

CVE-2021-43667