indy-node Client Connection resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in indy-node. Affected by this issue is some unknown functionality of the component Client Connection Handler. Performing a manipulation results in resource consumption. This vulnerability is cataloged as CVE-2022-31006. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in indy-node (affected version unknown). This affects an unknown functionality of the component Client Connection Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions of indy-node, an attacker can max out the number of client connections allowed by the ledger, leaving the ledger unable to be used for its intended purpose. However, the ledger content will not be impacted and the ledger will resume functioning after the attack. This attack exploits the trade-off between resilience and availability. Any protection against abusive client connections will also prevent the network being accessed by certain legitimate users. As a result, validator nodes must tune their firewall rules to ensure the right trade-off for their network's expected users. The guidance to network operators for the use of firewall rules in the deployment of Indy networks has been modified to better protect against denial of service attacks by increasing the cost and complexity in mounting such attacks. The mitigation for this vulnerability is not in the Hyperledger Indy code per se, but rather in the individual deployments of Indy. The mitigations should be applied to all deployments of Indy, and are not related to a particular release.

The weakness was shared 09/10/2022 as GHSA-x996-7qh9-7ff7. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2022-31006 since 05/18/2022. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Applying the patch 53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3 is able to eliminate this problem. The bugfix is ready for download at github.com.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• indy-node

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion