Detections
Analytics

SCA: security update for github.com/hyperledger/fabric (GHSA-v9w2-543f-h69m)

medium Tenable Self-Hosted Container Security Plugin ID 419242

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to
 one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all
 atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the
 transactions in a way that alters the way the peers parse the transactions. If a first peer receives a
 block B and a second peer receives a block identical to B but with the transactions being cross-linked,
 the second peer will parse transactions in a different way and thus its world state will deviate from the
 first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there
 is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates
 them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked
 transactions) which alters the way peers process transactions. For example, it is possible to select a
 transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of
 the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking
 issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this
 vulnerability. (CVE-2023-46132)

See Also

https://github.com/advisories/GHSA-v9w2-543f-h69m

Plugin Details

Severity: Medium

ID: 419242

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2023-46132

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/14/2023

Vulnerability Publication Date: 11/14/2023

Reference Information

CVE: CVE-2023-46132

cwe: CWE-362