CVE-2023-39533

CVSS 3.1 Score 7.5 of 10 (high)

Details

Published Aug 8, 2023
Updated: Oct 31, 2023
CWE ID 770

Summary

CVE-2023-39533 is a high-severity vulnerability affecting go-libp2p, the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1, a malicious peer could exploit this vulnerability to launch a resource exhaustion attack by using large RSA keys, causing the targeted node to spend time on signature verification of the large key. This vulnerability exists in the core/crypto module of go-libp2p during the Noise handshake and the libp2p x509 extension verification step. To mitigate this issue, it is advised to update go-libp2p to versions 0.27.8, 0.28.2, or 0.29.1, as well as use the updated Go compiler in either version 1.20.7 or 1.19.12. There are no known workarounds for this vulnerability, which has a high risk score and potential impact on availability for organizations using these affected products.

Leverage our Vulnerability Intelligence module to secure your systems now - get detailed insights on CVE-2024-37364. Book your demo today.

Share

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-39533 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options