132 matches found
hlf-time-oracle
hlf-time-oracle hlf-time-oracle 是一个为区块链 Hyperledger Fabric 提供的链码，用于向其他链码提供精确时间。hlf-time-oracle 基于 ntp 包 和 nts 包。从而解决了区块链客户端可能通过 交易时间操纵（CVE-2024-45244）带来的安全问题。该链码提供了 GetTimeNtp 和 GetTimeNts 函数。调用这些函数会触发对 NTP（网络时间协议）和 NTS（网络时间安全）服务器的请求。从这些服务器获取的时间可用于验证客户端定义的事务时间的正确性。区块链链码开发者可以使用...
HLF_TxTime_spoofing
HLFTxTimespoofing HLFTxTimespoofing - Hyperledger Fabric 블록체인에서 트랜잭션 시간 조작GetTxTimestamp 또는 GetHistoryForKey 사용 문제를 다루는 PoC입니다. v 2.5.5 및 v3.0.0-beta에서 테스트되었습니다. 프로젝트는 여러 부분으로 구성됩니다: 1. timeinsecure - 예치금에서 이자를 계산하기 위해 GetTxTimestamp를 사용하는 취약한 체인코드 변형 2. timesecurentp - 예치금 이자 계산 시 공격자의 시간 스푸핑을...
CVE-2026-45581
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...
EUVD-2026-35139
fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in...
Hyperledger Fabric Chaincode Java 日志信息泄露漏洞
Hyperledger Fabric Chaincode Java is an open-source Java-based smart contract development framework developed by the Hyperledger project. In versions 2.3.1 to 2.5.10 of Hyperledger Fabric Chaincode Java, there was a vulnerability involving log information leakage. This vulnerability occurred when...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
BIT-HYPERLEDGER-FABRIC-PEER-2026-41586 ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
Deserialization Of Untrusted Data
org.hyperledger.fabric-sdk-java, fabric-sdk-java is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to Channel.java implementing readObject and exposing deSerializeChannel, which invoke ObjectInputStream.readObject on untrusted byte arrays without configuring an...
com.baoquan:verax-sdk (1.0.0), com.easypayx:easypay-blockchain-java-sdk (>=1.0.0, <=1.0.4) +21 more potentially affected by CVE-2026-41586 via org.hyperledger.fabric-sdk-java:fabric-sdk-java (>=1.0.1, <=2.2.26)
org.hyperledger.fabric-sdk-java:fabric-sdk-java MAVEN version =1.0.1, =1.0.0, =1.0.0-release, =1.0.0-release, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =3.16.1, =1.2.0, =1.3.0, =0.10.1, =014.1 and more Source cves: CVE-2026-41586 Source advisory: SNYK:JAVA-ORGHYPERLEDGERFABRICSDKJAVA-16439197...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
CVE-2026-41586
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
EUVD-2026-28316
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject and exposes deSerializeChannel which call ObjectInputStream.readObject on untrusted byte arrays without...
Hyperledger Fabric 代码问题漏洞
Hyperledger Fabric is an enterprise-level, open-source distributed ledger framework developed by the Hyperledger project. It is used for developing solutions and applications. Versions of Hyperledger Fabric from 1.0.0 to 2.2.26 contained code vulnerabilities that could lead to remote code...
PT-2026-37132
Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions 1.0.0 through 2.2.26 Description In the deprecated fabric-sdk-java client SDK, the Channel.java file implements readObject and exposes the deSerializeChannel function, both of which call ObjectInputStream.readObject...
CVE-2022-31121
Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error ...
EUVD-2021-2543
Malware in sbrugna...
EUVD-2022-6271
Malicious code in bioql PyPI...
EUVD-2022-0123
Malicious code in bioql PyPI...