@libp2p/gossipsub@16.0.4-ff9e5fc7c

A typescript implementation of gossipsub

latest version

17.2.1

latest non vulnerable version

17.2.1

first published

1 years ago

latest version published

2 days ago

licenses detected

Apache-2.0
>=14.1.1-6059227cb <17.1.1-d91797b55; >=17.1.1 <17.1.2-235711723

View gossipsub package health on Snyk (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @libp2p/gossipsub package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature @libp2p/gossipsub is an A typescript implementation of gossipsub Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the `validateToRawMessage` process. An attacker can cause messages to be accepted and propagated as if authored by a victim by supplying a victim's RSA peer ID in `msg.from`, signing the message with the attacker's private key, and providing the attacker's public key in `msg.key`. This allows attacker-controlled data to be processed under false origin attribution, potentially impacting validators, authorization, accounting, moderation, reputation, or audit logging. How to fix Improper Verification of Cryptographic Signature? Upgrade `@libp2p/gossipsub` to version 16.0.5 or higher.	>=15.0.0 <16.0.5

Improper Verification of Cryptographic Signature

@libp2p/gossipsub is an A typescript implementation of gossipsub

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the validateToRawMessage process. An attacker can cause messages to be accepted and propagated as if authored by a victim by supplying a victim's RSA peer ID in msg.from, signing the message with the attacker's private key, and providing the attacker's public key in msg.key. This allows attacker-controlled data to be processed under false origin attribution, potentially impacting validators, authorization, accounting, moderation, reputation, or audit logging.

How to fix Improper Verification of Cryptographic Signature?

Upgrade @libp2p/gossipsub to version 16.0.5 or higher.

>=15.0.0 <16.0.5

Go back to all versions of this package