Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/hyperledger/fabric: CVE-2021-43669 #267

Closed
GoVulnBot opened this issue Jan 7, 2022 · 2 comments
Labels
cve-year-2021 excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

In CVE-2021-43669, the reference URL github.com/hyperledger/fabric (and possibly others) refers to something in Go.

module: github.com/hyperledger/fabric
package: n/a
description: |
  A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
cves:
- CVE-2021-43669
links:
  pr: https://github.com/hyperledger/fabric/pull/2828
  context:
  - https://jira.hyperledger.org/browse/FAB-18528

See doc/triage.md for instructions on how to triage this report.

@neild
Copy link
Contributor

neild commented Jul 6, 2022

Vulnerability in tool/infeasible; see #266.

@neild neild closed this as completed Jul 6, 2022
@neild neild added excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. and removed NotGoVuln labels Aug 11, 2022
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
cve-year-2021 excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Development

No branches or pull requests

5 participants