GHSA-wc36-xgcc-jwpr: Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`

June 17, 2022

Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.

This allows an attacker to republish an existing PeerRecord with a different PeerId.

References

github.com/advisories/GHSA-wc36-xgcc-jwpr
github.com/libp2p/rust-libp2p
rustsec.org/advisories/RUSTSEC-2022-0009.html

Detect and mitigate GHSA-wc36-xgcc-jwpr with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →