PyPI: indy-node
CVE-2020-11090
Safety vulnerability ID: SFTY-20200611-02544
Safety legacy ID: pyup.io-42272
In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
Overview
Uncontrolled Resource Consumption in Indy Node
Advisory
In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20200611-02544/CVE-2020-11090
- https://github.com/hyperledger/indy-node/security/advisories/GHSA-3gw4-m5w7-v89c
- https://nvd.nist.gov/vuln/detail/CVE-2020-11090
- https://github.com/hyperledger/indy-node/blob/master/CHANGELOG.md#1123
- https://github.com/pypa/advisory-database/tree/main/vulns/indy-node/PYSEC-2020-47.yaml
- https://pypi.org/project/indy-node/1.12.3
- https://github.com/advisories/GHSA-3gw4-m5w7-v89c
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more