https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:45:13 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-233756 EUVD-2026-233756 https://cve.radiocsirt.org/vuln/euvd-2026-233756 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31020 <p>Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.</p> <p>Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-31020 https://cve.radiocsirt.org/vuln/ghsa-r6v9-p59m-gj2p <p><strong>Affected:</strong> PyPI: indy-node</p> <p>### Impact</p> <p>The `pool-upgrade` request handler in Indy-Node `&lt;=1.12.4` allows an improperly authenticated attacker to remotely execute code on nodes within the network.</p> <p>Network operators are strongly encouraged to upgrade to the latest Indy-Node release `&gt;=1.12.5` as soon as possible.</p> <p>### Patches</p> <p>The `pool-upgrade` request handler in Indy-Node `&gt;=1.12.5` has been updated to properly authenticate `pool-upgrade` transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution.</p> <p>### Mitigations</p> <p>Network operators are strongly encouraged to upgrade to the latest Indy-Node release `&gt;=1.12.5` as soon as possible.</p> <p>### Acknowledgements Thank you to @shakreiner at CyberArk Labs for finding and responsibly disclosing this issue.</p> <p><strong>Affected:</strong> PyPI: indy-node</p> <p>### Impact</p> <p>The `pool-upgrade` request handler in Indy-Node `&lt;=1.12.4` allows an improperly authenticated attacker to remotely execute code on nodes within the network.</p> <p>Network operators are strongly encouraged to upgrade to the latest Indy-Node release `&gt;=1.12.5` as soon as possible.</p> <p>### Patches</p> <p>The `pool-upgrade` request handler in Indy-Node `&gt;=1.12.5` has been updated to properly authenticate `pool-upgrade` transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution.</p> <p>### Mitigations</p> <p>Network operators are strongly encouraged to upgrade to the latest Indy-Node release `&gt;=1.12.5` as soon as possible.</p> <p>### Acknowledgements Thank you to @shakreiner at CyberArk Labs for finding and responsibly disclosing this issue.</p> https://cve.radiocsirt.org/vuln/ghsa-r6v9-p59m-gj2p https://cve.radiocsirt.org/vuln/gsd-2022-31020 gsd-2022-31020 https://cve.radiocsirt.org/vuln/gsd-2022-31020 https://cve.radiocsirt.org/vuln/pysec-2022-265 <p><strong>Affected:</strong> PyPI: indy-node</p> <p>Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.</p> <p><strong>Affected:</strong> PyPI: indy-node</p> <p>Indy Node is the server portion of a distributed ledger purpose-built for decentralized identity. In versions 1.12.4 and prior, the `pool-upgrade` request handler in Indy-Node allows an improperly authenticated attacker to remotely execute code on nodes within the network. The `pool-upgrade` request handler in Indy-Node 1.12.5 has been updated to properly authenticate pool-upgrade transactions before any processing is performed by the request handler. The transactions are further sanitized to prevent remote code execution. As a workaround, endorsers should not create DIDs for untrusted users. A vulnerable ledger should configure `auth_rules` to prevent new DIDs from being written to the ledger until the network can be upgraded.</p> https://cve.radiocsirt.org/vuln/pysec-2022-265