GitHub Advisoryadvisory · npm

GHSA-j3ff-xp6c-6gcc Failure to validate signature during handshake

HIGH Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2022-24759
Ecosystem
npm
Packages
@chainsafe/libp2p-noise
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-347
Reviewed
2022-03-18

Affected packages

• npm @chainsafe/libp2p-noise: < 4.1.2 → fixed in 4.1.2 • npm @chainsafe/libp2p-noise: >= 5.0.0, < 5.0.3 → fixed in 5.0.3

Description

Impact `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Patches Users should upgrade to 4.1.2 or 5.0.3 Workarounds No workarounds, just patch upgrade References https://github.com/ChainSafe/js-libp2p-noise/pull/130

Related

Alias · CVE (1)

  • CVE-2022-24759 `@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol, an encryption protocol used in libp2p. vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References