Hyperledger Fabric does not verify request has a timestamp within the expected time window

MEDIUM 5.3CVE-2024-45244 · BIT-hyperledger-fabric-orderer-2024-45244 · BIT-hyperledger-fabric-peer-2024-45244 · Published 25/08/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/hyperledger/fabric Go	`≤ 2.5.9all versions`	No fix yet
fabric hyperledger	`≤ 2.5.9`	No fix yet

Description

Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window.

NVD description

Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.

References

nvd.nist.gov/vuln/detail/CVE-2024-45244 · ADVISORY
hyperledger/fabric commit 155457a · WEB
hyperledger/fabric · PACKAGE
shanker-sec/HLF_TxTime_spoofing · WEB
shanker-sec/hlf-time-oracle · WEB
GitHub Advisory GHSA-48gg-32q2-4r6m · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free