141 matches found
HLF_TxTime_spoofing
HLFTxTimespoofing HLFTxTimespoofing: una PoC que cubre el problema de la manipulación de la hora de las transacciones usando GetTxTimestamp o GetHistoryForKey en la blockchain Hyperledger Fabric. Probado en v2.5.5 y v3.0.0-beta. El proyecto consta de varias partes: 1. timeinsecure: variante del...
hlf-time-oracle
hlf-time-oracle hlf-time-oracle es un chaincode para blockchain Hyperledger Fabric que proporciona hora precisa a otros chaincodes. hlf-time-oracle se basa en el paquete ntp y en el paquete nts. De esta manera se resuelve el problema de seguridad asociado con la posible manipulación del tiempo de...
CVE-2026-53658
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...
EUVD-2026-78835
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...
CVE-2026-53658 Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...
CVE-2026-53658 Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...
CVE-2026-53658
CVE-2026-53658 affects Hyperledger Fabric CA prior to version 1.5.21 . When configured with an LDAP backend , the function Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters . An ...
CVE-2026-53658 Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters...
Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java (CVE-2026-41586)
Summary IBM® Db2® federated server is affected by a vulnerability in fabric-sdk-java Vulnerability Details CVEID:CVE-2026-41586 DESCRIPTION: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26...
GO-2026-6234 LDAP injection via unescaped username in github.com/hyperledger/fabric-ca
LDAP injection via unescaped username in github.com/hyperledger/fabric-ca...
CVE-2026-45581
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...
EUVD-2026-35139
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...
Hyperledger Fabric Chaincode Java 日志信息泄露漏洞
Hyperledger Fabric Chaincode Java is an open-source Java-based smart contract development framework developed by the Hyperledger project. In versions 2.3.1 to 2.5.10 of Hyperledger Fabric Chaincode Java, there was a vulnerability involving log information leakage. This vulnerability occurred when...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
BIT-HYPERLEDGER-FABRIC-PEER-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
Deserialization Of Untrusted Data
org.hyperledger.fabric-sdk-java, fabric-sdk-java is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Channel.java implementing readObject and exposing deSerializeChannel, which invoke ObjectInputStream.readObject on untrusted byte arrays without configuring an...
com.baoquan:verax-sdk (1.0.0), com.easypayx:easypay-blockchain-java-sdk (>=1.0.0, <=1.0.4) +21 more potentially affected by CVE-2026-41586 via org.hyperledger.fabric-sdk-java:fabric-sdk-java (>=1.0.1, <=2.2.26)
org.hyperledger.fabric-sdk-java:fabric-sdk-java MAVEN version =1.0.1, =1.0.0, =1.0.0-release, =1.0.0-release, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =3.16.1, =1.2.0, =1.3.0, =0.10.1, =014.1 and more Source cves: CVE-2026-41586 Source advisory: SNYK:JAVA-ORGHYPERLEDGERFABRICSDKJAVA-16439197...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
EUVD-2026-28316
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...