CVE-2023-39533: libp2p nodes vulnerable to attack using large RSA keys
(updated )
A malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p now restricts RSA keys to <= 8192 bits.
References
- github.com/advisories/GHSA-876p-8259-xjgg
- github.com/golang/go/commit/2350afd2e8ab054390e284c95d5b089c142db017
- github.com/golang/go/issues/61460
- github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
- github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00
- github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d
- github.com/libp2p/go-libp2p/pull/2454
- github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
- github.com/quic-go/quic-go/pull/4012
- go.dev/issue/61460
- nrdax.com/techniques/NRDAX-T0205-pre-handshake-crypto-cpu-burn
- nvd.nist.gov/vuln/detail/CVE-2023-39533
Code Behaviors & Features
Detect and mitigate CVE-2023-39533 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →