CVE-2022-31006: Indy node Denial of Service Vulnerability
HIGHCVE-2022-31006 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Indy node libraries in the PyPI ecosystem. The issue involves hyperledger indy-node vulnerable to denial of service. Remediation is available in the latest vendor maintenance releases.
CVE-2022-31006 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2022-31006
To remediate this vulnerability, upgrade all affected Indy node dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install indy-node>=Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show indy-nodeHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2022-31006, inspect your installed packages using pip:
pip show indy-nodeAnalyze the terminal output to locate any version of Indy node in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: The pip show indy-node command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Indy node, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2022-31006 Affected Indy node Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
indy-node
|
PyPI |
≤ 1.12.6
|
|
References
Frequently Asked Questions
What is CVE-2022-31006?
Which Indy node versions are affected?
What version fixes CVE-2022-31006?
Is indy-node affected?
What is the CVSS score of CVE-2022-31006?
What CWE is associated with CVE-2022-31006?
How can I check PyPI dependencies for CVE-2022-31006?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-x996-7qh9-7ff7",
"modified" : "2022-10-10T17:04:26Z",
"published" : "2022-09-16T20:28:39Z",
"aliases" : [ "CVE-2022-31006" ],
"summary" : "Hyperledger indy-node vulnerable to denial of service",
"details" : "### Impact\n\nAn attacker can max out the number of client connections allowed by the ledger that was deployed using guidance provided in the indy-node repository, leaving the ledger unable to be used for its intended purpose.\n\nThe ledger content will not be impacted by the attack, and the ledger will resume servicing valid client requests after the attack.\n\n### Mitigations\n\nThis attack exploits the trade-off between resilience and availability. Any protection against abusive client connections will also prevent the network being accessed by certain legitimate users. As a result, validator nodes must tune their firewall rules to ensure the right trade-off for their network's expected users. The guidance previously provided enabled a low-cost DDoS attack.\n\nThe [guidance to network operators for the use of firewall rules](https://github.com/hyperledger/indy-node/blob/main/docs/source/setup-iptables.md) in the deployment of Indy networks has been modified to better protect against denial of service attacks by increasing the cost and complexity in mounting such attacks.\n\nThe mitigation for this vulnerability is not in the Hyperledger Indy code per se, but rather in the individual deployments of Indy. The mitigations should be applied to all deployments of Indy, and are not related to a particular release.\n\n### Acknowledgements\n\nThank you to Mirko Mollik at [TrustCerts.de](https://trustcerts.de) for finding and responsibly disclosing this issue.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "indy-node"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.12.6"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/hyperledger/indy-node/security/advisories/GHSA-x996-7qh9-7ff7"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-31006"
}, {
"type" : "WEB",
"url" : "https://github.com/hyperledger/indy-node/commit/53a2a1bf1a26cb8ba710fd6adc8bcf275186a4b3"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/hyperledger/indy-node"
}, {
"type" : "WEB",
"url" : "https://github.com/hyperledger/indy-node/commits/v1.13.2-rc2"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/indy-node/PYSEC-2022-270.yaml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2022-09-16T20:28:39Z",
"nvd_published_at" : "2022-09-09T19:15:00Z"
}
}