CVE-2022-24759: Failure to validate signature during handshake in @chainsafe/libp2p-noise
Summary
CVE-2022-24759: Failure to validate signature during handshake. Affects @chainsafe/libp2p-noise across 2 version ranges.
< 4.1.2
>= 5.0.0, < 5.0.3
Fixed in 4.1.2 or 5.0.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @chainsafe/libp2p-noise package is an npm package that provides functionality for the libp2p protocol. It is used for secure communication between peers in a decentralized network. The package implements the Noise Protocol Framework, which is a framework for building secure and efficient cryptographic protocols. The vulnerability in this package allows for a failure to validate signatures during the handshake process, which can be exploited by a man-in-the-middle attacker to pose as other peers and potentially get those peers banned from the network.
Vulnerability Detail
The vulnerability in @chainsafe/libp2p-noise arises from a failure to correctly validate signatures during the handshake process. This means that an attacker can intercept the communication between peers and impersonate other peers without being detected. This can lead to various security issues, such as unauthorized access to sensitive information, manipulation of network traffic, and potential banning of innocent peers. The vulnerability has a CVSS score of 8.1, indicating a high severity level. It is important to note that this vulnerability affects versions before 4.1.2 and 5.0.3 of the package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.24.1.2npm install @chainsafe/libp2p-noise@4.1.2 -
>= 5.0.0, < 5.0.35.0.3npm install @chainsafe/libp2p-noise@5.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The @chainsafe/libp2p-noise package before versions 4.1.2 and 5.0.3 is vulnerable to a failure to validate signatures during the handshake process. This can be exploited by a man-in-the-middle attacker to impersonate other peers and potentially get them banned from the network. To mitigate this vulnerability, users should upgrade to the fixed versions of the package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @chainsafe/libp2p-noise →
FAQ
@chainsafe/libp2p-noise is an npm package that provides secure communication functionality for the libp2p protocol.
The vulnerability allows a man-in-the-middle attacker to impersonate other peers and potentially get them banned from the network.
You can fix this vulnerability by upgrading to version 4.1.2 or 5.0.3 of the @chainsafe/libp2p-noise package.
No, the only solution is to upgrade to the fixed versions of the package.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
