CVE-2023-39533
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-39533 is a high-severity vulnerability affecting go-libp2p, the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1, a malicious peer could exploit this vulnerability to launch a resource exhaustion attack by using large RSA keys, causing the targeted node to spend time on signature verification of the large key. This vulnerability exists in the core/crypto module of go-libp2p during the Noise handshake and the libp2p x509 extension verification step. To mitigate this issue, it is advised to update go-libp2p to versions 0.27.8, 0.28.2, or 0.29.1, as well as use the updated Go compiler in either version 1.20.7 or 1.19.12. There are no known workarounds for this vulnerability, which has a high risk score and potential impact on availability for organizations using these affected products.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions