PT-2019-20066 · Libp2P · Libp2P-Secio

Publicado 2019-08-23 · Atualizado 2019-08-23

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions libp2p-secio versions prior to 0.9.0

Description The issue is related to an identity spoofing problem where the PeerId of DstPeer is not correctly verified against the PeerId discovered during the crypto handshake. This results in a high severity vulnerability.

Recommendations Update to version 0.9.0 or later.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

GHSA-RCH7-F4H5-X9RJ

Produtos afetados

Libp2P-Secio

Referências · 4

• https://github.com/libp2p/js-libp2p-secio/pull/95 · Nota
• https://osv.dev/vulnerability/GHSA-rch7-f4h5-x9rj · Aviso do Fabricante
• https://snyk.io/vuln/npm:libp2p-secio:20180115 · Nota
• https://npmjs.com/advisories/558 · Nota