Описание
Identity Spoofing in libp2p-secio
Affected versions of libp2p-secio does not correctly verify that the PeerId of DstPeer matches the PeerId discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability.
Recommendation
Update to version 0.9.0 or later.
Пакеты
Наименование
libp2p-secio
npm
Затронутые версииВерсия исправления
< 0.9.0
0.9.0
9.1 Critical
CVSS3
Дефекты
CWE-290
9.1 Critical
CVSS3
Дефекты
CWE-290