CVE-2020-11093: 
Python vulnerability analysis and mitigation

Hyperledger Indy Node, a server component for decentralized identity ledgers, contained a vulnerability in versions before 1.12.4 where there was insufficient signature verification on specific transactions. The vulnerability (CVE-2020-11093) was disclosed on December 24, 2020, and allowed attackers to make unauthorized alterations to the ledger (NVD).

The vulnerability stems from a lack of signature verification when updating a DID (Decentralized Identifier) with a nym transaction. The issue occurs when neither ROLE nor VERKEY fields are being changed, as the transaction would be written to the ledger regardless of the sender. This vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD, GitHub Advisory).

The vulnerability allows any DID with no particular role to modify another DID's information on the ledger. This leads to three main impacts: 1) Any DID can spam the ledger with nym transactions, 2) Any DID can change any other DID's alias, and 3) The update transaction can modify the ledger metadata associated with a DID (GitHub Advisory).

The vulnerability can be exploited by creating a new DID with no role and using it to send unauthorized updates to other DIDs on the ledger. The attack requires no special privileges and can be executed remotely. A proof of concept exploit has been documented showing how an attacker can modify the 'from' field of a TRUSTEE's DID (GitHub Advisory).

The vulnerability was patched in Indy Node version 1.12.4 by implementing proper authentication checks for nym transactions. The fix involves skipping auth rules checks for transactions that don't change either role or verkey fields (Indy Node Patch).