Libp2P
CVE-2023-39533
HIGH
GHSA-876p-8259-xjgg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.
AnalysisAI
go-libp2p is the Go implementation of the libp2p Networking Stack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Technical ContextAI
This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue. Affected products include: Libp2P Go-Libp2P.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting clien
Rust Yamux prior to version 0.13.10 is vulnerable to denial of service when processing specially crafted inbound stream
Unbounded abort listener accumulation in js-libp2p's circuit-relay-v2 relay server allows any remote peer to exhaust mem
Uncontrolled resource consumption in py-libp2p's yamux stream multiplexer allows any remote peer that completes a standa
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to
go-libp2p is the offical libp2p implementation in the Go programming language. Rated high severity (CVSS 7.5), this vuln
js-libp2p is the official javascript Implementation of libp2p networking stack. Rated high severity (CVSS 7.5), this vul
libp2p-rust is the official rust language Implementation of the libp2p networking stack. Rated high severity (CVSS 7.5),
An issue was discovered in the libp2p-core crate before 0.8.1 for Rust. Rated high severity (CVSS 7.5), this vulnerabili
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today