Hyperledger Fabric Chaincode Java TLS Private Key Password Logging Vulnerability

A vulnerability exists in Hyperledger Fabric Chaincode Java versions 2.3.1 prior to 2.5.10, when deployed in chaincode-as-a-service mode with TLS enabled. The chaincode server's INFO level logs inadvertently include the TLS private key password in plaintext. An attacker with access to these logs could retrieve the password, and if they also obtain the TLS private key, they could impersonate the chaincode server.

Impact

Exposing the TLS private key password in logs could lead to unauthorized impersonation of the chaincode server, especially if the private key is also compromised.

Remediation

Users are advised to update to version 2.5.10 or later, redact or remove any logs containing the TLS private key password, and change the TLS private key password. Additionally, impacted deployments can temporarily mitigate the issue by lowering the logging level to WARNING or higher to prevent INFO level logs from being recorded.