PT-2019-14261 · Parity Technologies · Libp2P-Core

Publicado 2019-05-15 · Atualizado 2021-08-25 · CVE-2019-15545

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libp2p-core crate versions prior to 0.8.1

Description An issue in the libp2p-core crate allows attackers to spoof ed25519 signatures. The affected versions did not properly verify ed25519 signatures, considering any signature with a correct length as valid. This enables an attacker to impersonate any node identity.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider implementing additional signature verification measures to prevent impersonation attacks. Restrict access to sensitive node identities until the update is applied.

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2019-15545

GHSA-4Q4X-67HX-5MPG

RUSTSEC-2019-0004

Produtos afetados

Libp2P-Core

Referências · 7

• https://github.com/libp2p/rust-libp2p · Nota
• https://osv.dev/vulnerability/CVE-2019-15545 · Aviso do Fabricante
• https://osv.dev/vulnerability/RUSTSEC-2019-0004 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-15545 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4q4x-67hx-5mpg · Aviso do Fabricante
• https://crates.io/crates/libp2p-core · Nota
• https://rustsec.org/advisories/RUSTSEC-2019-0004.html · Nota