GHSA-xghw-p77p-3r7x: Go/github.com/hyperledger/fabric-ca vulnerability
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account.
Recommendation
- All users of fabric-ca with an LDAP backend should update to a fixed version. - For users not using an LDAP backend, no action is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/hyperledger/fabric-cato a version that resolves this vulnerability.Fixed in 1.5.21
Event History
Frequently Asked Questions
What is the severity of GHSA-xghw-p77p-3r7x?
The severity of GHSA-xghw-p77p-3r7x is rated at 57.
What vulnerabilities does GHSA-xghw-p77p-3r7x address?
GHSA-xghw-p77p-3r7x addresses a potential LDAP injection vulnerability due to improper escaping of usernames in the LDAP uid search filter.
How do I fix GHSA-xghw-p77p-3r7x?
To fix GHSA-xghw-p77p-3r7x, ensure that the fabric-ca configuration properly escapes user input before it is used in LDAP search filters.
Who is affected by GHSA-xghw-p77p-3r7x?
Any deployment of fabric-ca configured with an LDAP backend could be affected by GHSA-xghw-p77p-3r7x.
What should I do if I am exposed to GHSA-xghw-p77p-3r7x?
If exposed to GHSA-xghw-p77p-3r7x, review your fabric-ca configurations and apply the necessary updates to mitigate the vulnerability.