GitHub Advisoryadvisory · npm

GHSA-j59f-6m4q-62h6 Improper Key Verification in ipns

HIGH Published 2019-05-30 Modified 2023-12-07 Official page ↗
Ecosystem
npm
Packages
ipns
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-287
Reviewed
2019-05-30

Affected packages

• npm ipns: < 0.1.3 → fixed in 0.1.3

Description

Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid. Recommendation Update to version 0.1.3 or later.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References