-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hyperledger/fabric | go | < 2.2.7 | 2.2.7 |
| github.com/hyperledger/fabric | go | >= 2.3.0, < 2.4.5 | 2.4.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper input validation in the consensus request handling path. The commit diff shows critical changes in service.go where the message handling logic was modified to explicitly check for both SubmitRequest and ConsensusRequest types, adding an error return for malformed messages. The added test TestEmptyRequest in comm_test.go demonstrates that empty/malformed requests could previously cause crashes. The handleMessage() function was vulnerable because it would attempt to dispatch consensus requests without validating the message structure, allowing nil or improperly formatted consensus messages to propagate through the system.