Lucene search

K
osvGoogleOSV:GHSA-J3FF-XP6C-6GCC
HistoryMar 18, 2022 - 6:57 p.m.

Failure to validate signature during handshake

2022-03-1818:57:53
Google
osv.dev
8

0.001 Low

EPSS

Percentile

41.4%

Impact

@chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.
This may allow a man-in-the-middle to pose as other peers and get those peers banned.

Patches

Users should upgrade to 4.1.2 or 5.0.3

Workarounds

No workarounds, just patch upgrade

References

https://github.com/ChainSafe/js-libp2p-noise/pull/130

0.001 Low

EPSS

Percentile

41.4%

Related for OSV:GHSA-J3FF-XP6C-6GCC