x/vulndb: potential Go vuln in github.com/hyperledger/fabric: CVE-2021-43667

[GoVulnBot]

In CVE-2021-43667, the reference URL github.com/hyperledger/fabric (and possibly others) refers to something in Go.

• PR: FAB-18529 added null check in channel header parsing (backport #2838) hyperledger/fabric#2844

module: github.com/hyperledger/fabric
package: n/a
description: |
  A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
cves:
- CVE-2021-43667
links:
  pr: https://github.com/hyperledger/fabric/pull/2844
  context:
  - https://jira.hyperledger.org/browse/FAB-18529

See doc/triage.md for instructions on how to triage this report.

[neild]

So far as I can tell, while the fix appears in a publicly importable package (github.com/hyperledger/fabric/protoutil), the vulnerability is in a server binary.

The github.com/hyperledger/fabric module does not follow standard Go module versioning (more recent versions are tagged v2.x.y, but the go.mod contains a v0/v1 module path), and there is no way to express a version range containing the fix in terms of module versions.

Closing as a combination of "vulnerability in tool" and "inexpressible version range".

[gopherbot]

Change https://go.dev/cl/592766 mentions this issue: data/reports: unexclude 50 reports