PT-2022-16021 · Js-Libp2P · Js-Libp2P

P-Shahi · Published 2022-12-07 · Updated 2023-07-14 · CVE-2022-23487

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions js-libp2p versions prior to v0.38.0

Description The issue concerns targeted resource exhaustion attacks that affect libp2p's connection, stream, peer, and memory management. An attacker can cause the allocation of large amounts of memory, leading to the process being killed by the host's operating system. The connection manager in js-libp2p, designed to handle regular peer churn, is not equipped to handle such targeted attacks.

Recommendations For versions prior to v0.38.0, update the js-libp2p dependency to v0.38.0 or greater. As a temporary mitigation measure, consider using OS tools to block malicious peers or implementing a load balancer in front of libp2p nodes. Additionally, utilize the allow/deny list in js-libp2p to deny specific peers, but note that these measures are no substitute for upgrading js-libp2p.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2022-23487

GHSA-F44Q-634C-JVWV

Affected Products

Js-Libp2P

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23487.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23487 · Security Note
• https://osv.dev/vulnerability/GHSA-f44q-634c-jvwv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23487 · Vendor Advisory
• https://github.com/libp2p/js-libp2p · Note
• https://github.com/libp2p/js-libp2p/security/advisories/GHSA-f44q-634c-jvwv · Note
• https://t.me/cvenotify/39378 · Telegram Post
• https://t.me/cvenotify/39392 · Telegram Post
• https://t.me/cibsecurity/54144 · Telegram Post