CVE-2018-3756

HIGH

Hyperledger Iroha v1.0_beta & v1.0.0_beta-1 - Signature Verification Bypass

Title source: llm
STIX 2.1

Description

Hyperledger Iroha versions v1.0_beta and v1.0.0_beta-1 are vulnerable to transaction and block signature verification bypass in the transaction and block validator allowing a single node to sign a transaction and/or block multiple times, each with a random nonce, and have other validating nodes accept them as separate valid signatures.

References (1)

Core 1
Core References
Third Party Advisory x_refsource_confirm
https://github.com/hyperledger/iroha/releases/tag/v1.0.0_beta-2

Scores

CVSS v3 7.5
EPSS 0.0082
EPSS Percentile 52.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-347
Status published
Products (2)
hyperledger/iroha 1.0 beta
hyperledger/iroha 1.0.0 beta1
Published Jun 01, 2018
Tracked Since Feb 18, 2026