ChainSafe js-libp2p-noise 资源管理错误漏洞

ChainSafe js-libp2p-noise is an open source implementation of TypeScript containing the noise protocol from ChainSafe Canada. A resource management error vulnerability exists in ChainSafe js-libp2p versions prior to 0.38.0, which stems from vulnerability to targeted resource exhaustion attacks th...

Man In The Middle (MitM)

@chainsafe/libp2p-noise is vulnerable to Man In The Middle attack. The vulnerability exists due to a lack of validation of signature during handshake process...

@chainsafe/lodestar (>=0.28.2-dev.9, <=0.29.3-dev.5), @chainsafe/lodestar-cli (>=0.28.2-dev.0, <=0.28.2-dev.18) potentially affected by CVE-2022-24759 via @chainsafe/libp2p-noise (4.1.0)

@chainsafe/libp2p-noise NPM version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @chainsafe/libp2p-noise and may be impacted: - @chainsafe/lodestar =0.28.2-dev.9, =0.28.2-dev.0, =0.28.2-dev.18 Source cves: CVE-2022-24759 Source advisory:...

@dcdn/client (0.0.1), @dcdn/cloudflare-worker (0.0.1) +5 more potentially affected by CVE-2022-24759 via @chainsafe/libp2p-noise (>=5.0.0, <=5.0.2)

@chainsafe/libp2p-noise NPM version =5.0.0, =1.85.0-next.40, =1.85.0-next.40, =1.85.0-next.40, =1.89.0-next.0 Source cves: CVE-2022-24759 Source advisory: OSV:GHSA-J3FF-XP6C-6GCC...

Code injection

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

CVE-2022-24759 Failure to validate signature during handshake in @chainsafe/libp2p-noise

@chainsafe/libp2p-noise contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. @chainsafe/libp2p-noise before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and ge...

ChainSafe js-libp2p-noise 数据伪造问题漏洞

ChainSafe js-libp2p-noise is an open source implementation of TypeScript containing the noise protocol from ChainSafe Canada. ChainSafe js-libp2p-noise is vulnerable to a data forgery issue that allows a man-in-the-middle to impersonate other peers and disable those peers...