{"id":"CVE-2024-45244","aliases":["BIT-hyperledger-fabric-orderer-2024-45244","BIT-hyperledger-fabric-peer-2024-45244","BIT-hyperledger-fabric-tools-2024-45244","EUVD-2024-2485","GHSA-48gg-32q2-4r6m","GO-2024-3099"],"status":"published","title":"Hyperledger Fabric does not verify request has a timestamp within the expected time window","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00589,"percentile":0.48437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-285","CWE-294","CWE-672"],"published":"2024-08-25T00:00:00Z","modified":"2026-10-28T02:31:14Z","exploits":[{"source":"pocgithub","id":"shanker-sec/HLF_TxTime_spoofing","title":"shanker-sec/HLF_TxTime_spoofing","date":"2024-06-23","url":"https://github.com/shanker-sec/HLF_TxTime_spoofing"},{"source":"pocgithub","id":"shanker-sec/hlf-time-oracle","title":"shanker-sec/hlf-time-oracle","date":"2024-07-28","url":"https://github.com/shanker-sec/hlf-time-oracle"}],"fixes":[{"ecosystem":"Bitnami","package":"hyperledger-fabric-orderer","fixed_in":["2.5.10"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hyperledger-fabric-peer","fixed_in":["2.5.10"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"hyperledger-fabric-tools","fixed_in":["2.5.10"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hyperledger/fabric","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.5.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-orderer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-peer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.10"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"hyperledger-fabric-tools","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hyperledger/fabric","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.5.9"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hyperledger/fabric","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"hyperledger","product":"fabric"}],"references":[{"url":"https://github.com/hyperledger/fabric/commit/155457a6624b3c74b22e5729c35c8499bfe952cd","tags":["Patch","fix","web"]},{"url":"https://github.com/shanker-sec/HLF_TxTime_spoofing","tags":["web","package"]},{"url":"https://github.com/shanker-sec/hlf-time-oracle","tags":["web","package"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45244","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-48gg-32q2-4r6m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45244.json","tags":["advisory"]},{"url":"https://github.com/hyperledger/fabric","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T00:00:00Z","modified":"2025-10-06T14:30:08.614Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-2485","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T00:00:00Z","modified":"2025-10-06T14:30:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:36.284733Z"}],"ghsa":[{"id":"GHSA-48gg-32q2-4r6m","title":"Hyperledger Fabric does not verify request has a timestamp within the expected time window","description":"Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T03:30:32Z","modified":"2025-10-13T15:12:41Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-285","CWE-294","CWE-672"],"updated_at":"2026-11-02T14:39:00.807341Z"}],"nvd":[{"id":"CVE-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T02:15:03.383Z","modified":"2026-06-17T07:53:50.777Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:10:21.771404Z"}],"osv":[{"id":"CVE-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T00:00:00Z","modified":"2026-10-28T02:31:14.791918629Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"GHSA-48gg-32q2-4r6m","title":"Hyperledger Fabric does not verify request has a timestamp within the expected time window","description":"Hyperledger Fabric through 2.5.9 does not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-08-25T03:30:32Z","modified":"2025-10-13T15:12:40Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-285","CWE-294","CWE-672"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"BIT-hyperledger-fabric-orderer-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-09-13T07:06:30.781Z","modified":"2026-09-08T08:47:53.715394787Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hyperledger-fabric-peer-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-09-13T07:06:32.87Z","modified":"2026-09-08T08:47:52.351980292Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"BIT-hyperledger-fabric-tools-2024-45244","description":"Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.","status":"published","published":"2024-09-13T07:06:32.766Z","modified":"2026-09-08T08:47:52.392196383Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2024-3099","title":"Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric","description":"Hyperledger Fabric does not verify request has a timestamp within the expected time window in github.com/hyperledger/fabric","status":"published","published":"2024-08-30T17:18:07Z","modified":"2026-03-03T04:55:44.884135Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}