CVE-2023-39533
2 advisories.
Go/github.com/libp2p/go-libp2p CVE-2023-39533: high 7.5, EPSS 1.50%
libp2p nodes vulnerable to attack using large RSA keys
Action: Upgrade github.com/libp2p/go-libp2p to 0.27.8 or later.
go get github.com/libp2p/go-libp2p@v0.27.8go get github.com/libp2p/go-libp2p@v0.28.2go get github.com/libp2p/go-libp2p@v0.29.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.27.8 | - |
| 0.28.0 | 0.28.2 | - |
| 0.29.0 | 0.29.1 | - |
Fixed versions
| 0.27.8 | 0.28.2 | 0.29.1 |
Sources
- osv: GHSA-876p-8259-xjgg
- https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
- https://nvd.nist.gov/vuln/detail/CVE-2023-39533
- https://github.com/golang/go/issues/61460
- https://github.com/libp2p/go-libp2p/pull/2454
- https://github.com/quic-go/quic-go/pull/4012
- https://github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
- https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
- https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00
- https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d
- https://github.com/libp2p/go-libp2p
- https://go.dev/issue/61460
- https://nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn
CVE-2023-39533 · published · modified · JSON
Go/github.com/libp2p/go-libp2p CVE-2023-39533: unknown, EPSS 1.50%
Large RSA keys can cause high resource usage in github.com/libp2p/go-libp2p
Action: Upgrade github.com/libp2p/go-libp2p to 0.27.8 or later.
go get github.com/libp2p/go-libp2p@v0.27.8go get github.com/libp2p/go-libp2p@v0.28.2go get github.com/libp2p/go-libp2p@v0.29.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.27.8 | - |
| 0.28.0 | 0.28.2 | - |
| 0.29.0 | 0.29.1 | - |
Fixed versions
| 0.27.8 | 0.28.2 | 0.29.1 |
Sources
- osv: GO-2023-2000
- https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
- https://go.dev/issue/61460
- https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
CVE-2023-39533 · published · modified · JSON