GHSA-j3ff-xp6c-6gccHighCVSS 8.1

Failure to validate signature during handshake

Published
March 18, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-24759 →

📋 Description

Impact

@chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned.

Patches

Users should upgrade to 4.1.2 or 5.0.3

Workarounds

No workarounds, just patch upgrade

References

https://github.com/ChainSafe/js-libp2p-noise/pull/130

🎯 Affected products2

  • npm/@chainsafe/libp2p-noise:< 4.1.2
  • npm/@chainsafe/libp2p-noise:>= 5.0.0, < 5.0.3

🔗 References (5)