@chainsafe/lodestar (>=0.28.2-dev.9, <=0.29.3-dev.5), @chainsafe/lodestar-cli (>=0.28.2-dev.0, <=0.28.2-dev.18) potentially affected by CVE-2022-24759 via @chainsafe/libp2p-noise (4.1.0)

@chainsafe/libp2p-noise NPM version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @chainsafe/libp2p-noise and may be impacted: - @chainsafe/lodestar =0.28.2-dev.9, =0.28.2-dev.0, =0.28.2-dev.18 Source cves: CVE-2022-24759 Source advisory:...

@dcdn/client (0.0.1), @dcdn/cloudflare-worker (0.0.1) +5 more potentially affected by CVE-2022-24759 via @chainsafe/libp2p-noise (>=5.0.0, <=5.0.2)

@chainsafe/libp2p-noise NPM version =5.0.0, =1.85.0-next.40, =1.85.0-next.40, =1.85.0-next.40, =1.89.0-next.0 Source cves: CVE-2022-24759 Source advisory: OSV:GHSA-J3FF-XP6C-6GCC...

CVE-2022-24759

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

CVE-2022-24759

In CVE-2022-24759, the @chainsafe/libp2p-noise TypeScript implementation fails to validate signatures during the handshake, enabling a potential man-in-the-middle impersonation of peers and subsequent banning. Affected versions are before 4.1.2 and 5.0.3. The documented remediation is to upgrade ...

CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...