Description
@chainsafe/libp2p-noise before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned.
Recommendation
Update the @chainsafe/libp2p-noise package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.0.3 < 4.1.2** Patched version(s): **5.0.3 4.1.2**
References
Could your website be exposed too?
SmartScanner can check your website for Failure to validate signature during handshake and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte vulnerable to XSS when using objects during server-side rendering - CVE-2022-25875
- JWS and JWT signature validation vulnerability with special characters - CVE-2022-25898
- Fastly Compute@Edge JS Runtime has fixed random number seed during compilation - CVE-2022-39218
- secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery - CVE-2022-41340
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023