~ / search / GHSA-r6v9-p59m-gj2p

GHSA-r6v9-p59m-gj2p

Indy's NODE_UPGRADE transaction vulnerable to remote code execution

Source: GitHub Advisory Database (reviewed) High CVE-2022-31020

Packages

EcosystemPackageAffectedFixed in
PyPI indy-node < 1.12.5rc1 1.12.5rc1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `pool-upgrade` request handler in Indy-Node `<=1.12.4` allows an improperly authenticated attacker to remotely execute code on nodes within the network. Network operators are strongly encouraged to upgrade to the latest Indy-Node release `>=1.12.5` as soon as possible. ### Patches The `pool-upgrade` request handler in Indy-Node `>=1.12.5` has been updated to properly authenticate `pool-upgrade` transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. ### Mitigations Network operators are strongly encouraged to upgrade to the latest Indy-Node release `>=1.12.5` as soon as possible. ### Acknowledgements Thank you to @shakreiner at CyberArk Labs for finding and responsibly disclosing this issue.

References

External links from the advisory. They lead to third-party sites.