PT-2019-14261 · Parity Technologies · Libp2P-Core

Published 2019-05-15 · Updated 2021-08-25 · CVE-2019-15545

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libp2p-core crate versions prior to 0.8.1

Description An issue in the libp2p-core crate allows attackers to spoof ed25519 signatures. The affected versions did not properly verify ed25519 signatures, considering any signature with a correct length as valid. This enables an attacker to impersonate any node identity.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 or later to resolve the issue. As a temporary workaround, consider implementing additional signature verification measures to prevent impersonation attacks. Restrict access to sensitive node identities until the update is applied.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2019-15545

GHSA-4Q4X-67HX-5MPG

RUSTSEC-2019-0004

Affected Products

Libp2P-Core

References · 7

• https://osv.dev/vulnerability/CVE-2019-15545 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2019-0004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15545 · Security Note
• https://osv.dev/vulnerability/GHSA-4q4x-67hx-5mpg · Vendor Advisory
• https://github.com/libp2p/rust-libp2p · Note
• https://crates.io/crates/libp2p-core · Note
• https://rustsec.org/advisories/RUSTSEC-2019-0004.html · Note