GitHub Advisoryadvisory · npm

GHSA-rch7-f4h5-x9rj Identity Spoofing in libp2p-secio

CRITICAL Published 2019-08-23 Modified 2021-08-17 Official page ↗
Ecosystem
npm
Packages
libp2p-secio
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-290
Reviewed
2019-08-22

Affected packages

• npm libp2p-secio: < 0.9.0 → fixed in 0.9.0

Description

Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. Recommendation Update to version 0.9.0 or later.

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References