CVE-2023-39533
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-39533 is a vulnerability affecting go-libp2p, the Go implementation of the libp2p Networking Stack, prior to versions 0.27.8, 0.28.2, and 0.29.1. Malicious peers can exploit this issue by using large RSA keys, leading to resource exhaustion attacks that force a node to spend significant time verifying the signatures of these keys. The vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and x509 extension verification steps. To mitigate this risk, it is recommended to update to go-libp2p versions 0.27.8, 0.28.2, and 0.29.1, and use the updated Go compiler in 1.20.7 or 1.19.12. No known workarounds exist for this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions