CVE-2020-11090 : What You Need to Know
Learn about CVE-2020-11090, a vulnerability in Indy Node 1.12.2 that can lead to uncontrolled resource consumption and network disruptions. Find mitigation steps and update recommendations here.
In Indy Node 1.12.2, there is a vulnerability that can lead to uncontrolled resource consumption, potentially causing network disruptions. This CVE has a CVSS base score of 7.5.
Understanding CVE-2020-11090
Indy Node version 1.12.2 is affected by an Uncontrolled Resource Consumption vulnerability, which can be exploited to crash the primary node and trigger view changes, potentially disrupting the network.
What is CVE-2020-11090?
This CVE refers to a bug in the TAA handling code of Indy Node 1.12.2 that allows a client to crash the primary node with a malformed transaction, leading to view changes and potential network instability.
The Impact of CVE-2020-11090
- CVSS Base Score: 7.5 (High)
- Attack Vector: Network
- Availability Impact: High
- No Confidentiality or Integrity Impact
- No Privileges Required
- Scope: Unchanged
- The vulnerability can result in repeated rapid view changes that have the potential to bring down the network.
Technical Details of CVE-2020-11090
Indy Node 1.12.2 is susceptible to uncontrolled resource consumption due to a bug in its TAA handling code.
Vulnerability Description
The vulnerability allows a client to crash the primary node with a malformed transaction, leading to view changes and potential network disruption.
Affected Systems and Versions
- Affected Product: Indy Node
- Vendor: Hyperledger
- Affected Version: 1.12.2
Exploitation Mechanism
The vulnerability can be exploited by sending a malformed transaction to the primary node, triggering view changes and potentially disrupting the network.
Mitigation and Prevention
To address CVE-2020-11090, immediate steps and long-term security practices are recommended.
Immediate Steps to Take
- Upgrade to version 1.12.3 of Indy Node to mitigate the vulnerability.
- Monitor network for any unusual view changes or disruptions.
Long-Term Security Practices
- Regularly update and patch software to prevent known vulnerabilities.
- Implement network monitoring and intrusion detection systems.
Patching and Updates
Ensure that all systems running Indy Node are updated to version 1.12.3 to patch the vulnerability.