GHSA-rch7-f4h5-x9rj Identity Spoofing in libp2p-secio
Attackers can spoof peer identities in libp2p-secio by bypassing PeerId verification during the crypto handshake, compromising secure communication integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-rch7-f4h5-x9rj?
GHSA-rch7-f4h5-x9rj is an authentication bypass vulnerability in libp2p-secio, published on 23 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of libp2p-secio does not correctly verify that the PeerId of DstPeer matches the PeerId discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability.
Recommendation
Update to version 0.9.0 or later.
Which versions are affected by GHSA-rch7-f4h5-x9rj?
2 open source packages ship an affected version, including libp2p-secio.
| Package | Affected | Fixed in |
|---|---|---|
libp2p-secio npm | All versions | 0.9.0 |
libp2p-secio npm | All versions | 0.9.0 |
How do I fix GHSA-rch7-f4h5-x9rj?
Upgrade libp2p-secio to 0.9.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-rch7-f4h5-x9rj being exploited?
There is no known exploitation of GHSA-rch7-f4h5-x9rj in the wild and no public exploit code.