libp2p-dns (>=0.1.0, <=0.4.0), libp2p-floodsub (>=0.1.0, <=0.4.0) +13 more potentially affected by CVE-2019-15545 via libp2p-core (>=0.1.0, <=0.4.0)

libp2p-core CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.0 Source cves: CVE-2019-15545 Source advisory: OSV:GHSA-4Q4X-67HX-5MPG...

CVE-2019-15545

CVE-2019-15545 affects the libp2p-core crate before 0.8.1 for Rust. The root cause is improper verification of ed25519 signatures, where any signature with a correct length could be treated as valid, allowing an attacker to impersonate any node identity. The vulnerability has multiple publicly li...

libp2p-dns (>=0.3.0, <=0.4.0), libp2p-floodsub (>=0.3.0, <=0.4.0) +13 more potentially affected by CVE-2019-15545 via libp2p-core (>=0.3.4, <=0.4.0)

libp2p-core CARGO version =0.3.4, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.4.0 Source cves: CVE-2019-15545 Source advisory: OSV:RUSTSEC-2019-0004...