CVE-2021-43667 NULL Pointer Dereference in HyperLedger Fabric
Attackers can crash leader nodes in HyperLedger Fabric by sending messages with nil payloads, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43667?
CVE-2021-43667 is a high-severity vulnerability in n/a, published on 18 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Weakness: CWE-476
Which versions are affected by CVE-2021-43667?
4 open source packages ship an affected version, including github.com/hyperledger/fabric. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hyperledger/fabric Go | All versions | 2.2.4 |
github.com/hyperledger/fabric Go | All versions | 2.2.4 |
github.com/hyperledger/fabric Go | From 2.3.0 | 2.3.3 |
github.com/hyperledger/fabric Go | From 2.3.0 | 2.3.3 |
Products include Linuxfoundation Fabric.
How do I fix CVE-2021-43667?
Upgrade github.com/hyperledger/fabric to a fixed version for your release line: 2.2.4 or 2.3.3.
Is CVE-2021-43667 being exploited?
There is no known exploitation of CVE-2021-43667 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vjj6-5m9f-wqjw.