Denial Of Service (DoS)

github.com/hyperledger/fabric is vulnerable to denial of service DoS attacks. Lack of validations in getChannelAndChaincodeFromSignedProposal function may cause a peer node crash when a gateway client application sends a malformed request to a gateway peer...

CVE-2022-36023

CVE-2022-36023 affects Hyperledger Fabric (gateway component). A malformed gateway request to a gateway peer can cause the peer to crash. The issue is addressed by upgrading to version 2.4.6, which implements input validation and returns an error to the gateway client instead of crashing. No publ...

GHSA-72X4-CQ6R-JP4P Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request

Impact If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. This fix checks for the malformed consensus request and returns an error to the consensus client. Specific Go Packages Affected github.com/hyperledger/fabric/orderer/common/cluster Patche...

Go Ethereum 资源管理错误漏洞

Go Ethereum is an official Go implementation of the Ether protocol for the Ethereum community. A resource management error vulnerability exists in Go Ethereum versions prior to 1.10.17. An attacker exploiting this vulnerability could systematically cause a crash when a node sends a specially...

Integer underflow in Frontier

Impact A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds and production WebAssembly binaries, the impact is limited as it can only cause a normal EVM out-of-gas. It is...

GHSA-CJG2-2FJG-FPH4 Integer underflow in Frontier

Impact A bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds and production WebAssembly binaries, the impact is limited as it can only cause a normal EVM out-of-gas. It is...

Integer overflow

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds and...

CVE-2022-21685 Integer underflow in Frontier

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds and...

CVE-2022-21685: Integer Underflow (Wrap or Wraparound)

Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 8a93fdc6c9f4eb1d2f2a11b7ff1d12d70bf5a664, a bug in Frontier's MODEXP precompile implementation can cause an integer underflow in certain conditions. This will cause a node crash for debug builds. For release builds and...

GHSA-GP6J-VX54-5PMF Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme

Summary In the threshold signature scheme, participants start by dividing secrets into shares using a secret sharing scheme. The Verifiable Secret Sharing scheme generates shares from the user’s IDs but does not properly validate them. Using a malicious ID will make other users reveal their secre...

CVE-2021-45700

An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service Nervos CKB blockchain node crash via a dead call that is used as a DepGroup...

Virtuozzo ReadyKernel patch 137.1 for Virtuozzo Hybrid Server 7.0, 7.5

The cumulative Virtuozzo ReadyKernel patch was updated with stability fixes. The patch applies to all supported kernels of Virtuozzo Hybrid Server 7.x. Vulnerability id: PSBM-136295 3.10.0-1127.8.2.vz7.151.14 to 3.10.0-1160.41.1.vz7.183.5 fs/locks.c: Node crash BUG in locksinsertblock...

CVE-2021-43667

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any...

Design/Logic Flaw

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any...

CVE-2021-39131

ced detects character encoding using Google’s compactencdet library. In ced v0.1.0, passing data types other than Buffer causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, verify it’s a Buffer using Buffer.isBuffero...

Github ced 输入验证错误漏洞

Github ced is a software application. Character encoding is detected using Google's compactencdet library. An Input Validation Error vulnerability exists in Github ced that stems from the product not doing valid validation of user input data types. An attacker could cause a Nodejs process to cras...

FISCO BCOS 输入验证错误漏洞

FISCO BCOS is a blockchain underlying platform. FISCO-BCOS suffers from an input validation error vulnerability that stems from a possible bug in the blockchain node's handling of unformatted packets, which can lead to a crash...

Denial of Service (DoS)

Overview xlsx is a Parser and writer for various spreadsheet formats. Affected versions of this package are vulnerable to Denial of Service DoS. An attacker who can send a malicious excel file parsed by this library can crash the Node.JS process. Note: xlsx package after version 0.18.5 is...

Product update: Virtuozzo 7.0 Update 13 (7.0.13-298)

The Update 13 for Virtuozzo 7.0 introduces new features and provides stability and usability bug fixes. It also introduces a new kernel 3.10.0-1062.12.1.vz7.131.10. Vulnerability id: PSBM-95072 'pstorage-target' files are left over after successful migrations of VMs on Virtuozzo Storage from...

GHSA-6663-C963-2GQG DoS due to excessively large websocket message in ws

Affected versions of ws do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload. Recommendation Update to version 1.1.1 or later. Alternatively, set the maxpayload option fo...