Quick answers
- Is CVE-2020-11090 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-11090 being exploited in the wild.
- How severe is CVE-2020-11090?
- Low severity, with a CVSS score of 3.1, published 11 June 2020.
- Which products and versions are affected?
- indy-node (PyPI) ECOSYSTEM:introduced=0,fixed=1.12.3, ECOSYSTEM:introduced=1.12.2,fixed=1.12.3.
- Is there a fix for CVE-2020-11090?
- Yes. indy-node (PyPI): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-11090 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-11090?
- Check whether you run indy-node (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- indy-node (PyPI): upgrade to 1.12.3 or later
pip install "indy-node>=1.12.3"
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the TAA (Transaction Author Agreement) handling code of Indy Node. When a client sends a malformed transaction with an invalid TAA, the primary node fails to validate it correctly and crashes, triggering a consensus view change. An unauthenticated network-reachable attacker can repeatedly send malformed TAA transactions to trigger cascading view changes that degrade or eliminate network consensus. The bug was fixed in version 1.12.3, released shortly after discovery on the Sovrin network in May 2020.
Affected products
- Hyperledger Indy Node 1.12.2
Identifiers
- CVE-2020-11090
- GHSA-3gw4-m5w7-v89c
- PYSEC-2020-47
Timeline
- 2020-06-08: disclosed
- 2020-06-11: patched: Fixed in version 1.12.3
- 2020-05-18: exploited: Discovered in wild on Sovrin StagingNet