PYSEC-2018-150

    Dashboard / Vulnerabilities / PYSEC-2018-150

    PYSEC-2018-150

    Published: 1 Jun 2018Last Modified: 21 Nov 2024

    Summary:

    Details: Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes accept them as separate valid signatures.

    References: https://github.com/hyperledger/iroha/releases/tag/v1.0.0_beta-2

    Affected packages

    Package

    Name: iroha

    Purl: pkg:pypi/iroha

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.0.1
    0.0.2
    0.0.5.1
    0.0.5.2
    0.0.5.3
    0.0.5.4
    0.0.5.5
    0.0.5.dev1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High