What is GHSA-rch7-f4h5-x9rj?

GHSA-rch7-f4h5-x9rj is a security advisory published by GitHub Security Advisories with Critical severity. Identity Spoofing in libp2p-secio

Why does GHSA-rch7-f4h5-x9rj have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-rch7-f4h5-x9rj?

GHSA-rch7-f4h5-x9rj has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rch7-f4h5-x9rj?

GHSA-rch7-f4h5-x9rj affects 1 product, including: npm/libp2p-secio:\u003c 0.9.0.

GHSA-rch7-f4h5-x9rjCriticalCVSS 9.1Disclosed before NVD

Identity Spoofing in libp2p-secio

Vendor

GitHub Security Advisories

Published

August 23, 2019

Last Modified

January 9, 2023

📋 Description

Affected versions of libp2p-secio does not correctly verify that the PeerId of DstPeer matches the PeerId discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability.

Recommendation

Update to version 0.9.0 or later.

🎯 Affected products1

npm/libp2p-secio:< 0.9.0

🔗 References (4)

https://github.com/libp2p/js-libp2p-secio/pull/95
https://www.npmjs.com/advisories/558
https://snyk.io/vuln/npm:libp2p-secio:20180115
https://github.com/advisories/GHSA-rch7-f4h5-x9rj