PYSEC-2020-47

2020-06-1100:15:00

Google

osv.dev

0.002 Low

EPSS

Percentile

54.3%

JSON

In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.

CPENameOperatorVersion
indy-nodeeq1.12.1.dev1149
indy-nodeeq1.11.0.dev1114
indy-nodeeq1.8.0.dev955
indy-nodeeq1.8.0.dev971
indy-nodeeq1.6.78
indy-nodeeq1.6.76
indy-nodeeq1.12.0.dev1128
indy-nodeeq1.8.0.dev917
indy-nodeeq1.12.2.dev1193
indy-nodeeq1.8.0.dev981

Name	Operator	Version
indy-node	eq	1.12.1.dev1149
indy-node	eq	1.11.0.dev1114
indy-node	eq	1.8.0.dev955
indy-node	eq	1.8.0.dev971
indy-node	eq	1.6.78
indy-node	eq	1.6.76
indy-node	eq	1.12.0.dev1128
indy-node	eq	1.8.0.dev917
indy-node	eq	1.12.2.dev1193
indy-node	eq	1.8.0.dev981