CVE-2024-45244 Hyperledger Fabric does not verify request has a timestamp within the expected time window
Attackers can bypass timestamp verification in Hyperledger Fabric, potentially replaying requests or manipulating transaction ordering.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45244?
CVE-2024-45244 is a medium-severity vulnerability in n/a, published on 25 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.
Weakness: CWE-294
Which versions are affected by CVE-2024-45244?
6 open source packages ship an affected version, including github.com/hyperledger/fabric, hyperledger-fabric-orderer and hyperledger-fabric-peer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/hyperledger/fabric Go | All versions | None |
github.com/hyperledger/fabric Go | All versions to 2.5.9 | None |
github.com/hyperledger/fabric Go | All versions to 2.5.9 | None |
hyperledger-fabric-orderer Bitnami | All versions | 2.5.10 |
hyperledger-fabric-peer Bitnami | All versions | 2.5.10 |
hyperledger-fabric-tools Bitnami | All versions | 2.5.10 |
Products include Hyperledger Fabric.
How do I fix CVE-2024-45244?
Upgrade to a fixed version.
Is CVE-2024-45244 being exploited?
There is no known exploitation of CVE-2024-45244 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
- CVE-2022-45196 Denial of service in n/a
- CVE-2022-31121 Improper Input Validation in fabric hyperledger
- CVE-2023-46132 Crosslinking transaction attack in hyperledger/fabric
- CVE-2022-36023 Remote denial of service in Hyperledger Fabric Gateway
Sources
Also known as BIT-hyperledger-fabric-orderer-2024-45244, BIT-hyperledger-fabric-peer-2024-45244, BIT-hyperledger-fabric-tools-2024-45244, GHSA-48gg-32q2-4r6m, GO-2024-3099.