CVE-2023-39533

Summary

CVE-2023-39533 is a vulnerability affecting go-libp2p, the Go implementation of the libp2p Networking Stack, prior to versions 0.27.8, 0.28.2, and 0.29.1. Malicious peers can exploit this issue by using large RSA keys, leading to resource exhaustion attacks that force a node to spend significant time verifying the signatures of these keys. The vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and x509 extension verification steps. To mitigate this risk, it is recommended to update to go-libp2p versions 0.27.8, 0.28.2, and 0.29.1, and use the updated Go compiler in 1.20.7 or 1.19.12. No known workarounds exist for this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.