CVE-2023-39533

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-39533
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39533.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-39533
Aliases
Published
2023-08-08T18:50:05.418Z
Modified
2026-03-11T15:22:25.403283Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libp2p nodes vulnerable to attack using large RSA keys
Details

go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39533.json"
}
References

Affected packages

Git / github.com/golang/go

Affected ranges

Type
Repo
https://github.com/golang/go
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2350afd2e8ab054390e284c95d5b089c142db017

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39533.json"

Git / github.com/libp2p/go-libp2p

Affected ranges

Type
GIT
Repo
https://github.com/libp2p/go-libp2p
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8506ab233441d434bb777615fffefab64b06f335
Last affected
636a0966a69a90d54128288465fb48c148741399
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.27.8"
        },
        {
            "last_affected": "= 0.29.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/libp2p/go-libp2p
Events
Introduced
703c3a4377d1ca2cf3fc93c92c883be1644f3ba6
Fixed
256b838b551a74e682e7fd2c5ac2022d09c78b94
Database specific 
{
    "versions": [
        {
            "introduced": "0.28.0"
        },
        {
            "fixed": "0.28.2"
        }
    ]
}

Affected versions

gx/v1.*
gx/v1.0.0
gx/v2.*
gx/v2.0.1
gx/v2.0.2
gx/v2.0.3
gx/v3.*
gx/v3.0.0
gx/v3.1.0
gx/v3.2.0
gx/v3.2.1
gx/v3.2.2
gx/v3.2.3
gx/v3.3.0
gx/v3.3.1
gx/v3.3.2
gx/v3.3.3
gx/v3.3.4
gx/v3.3.6
gx/v3.3.7
gx/v3.4.0
gx/v3.4.1
gx/v3.4.2
gx/v3.4.3
gx/v3.5.0
gx/v3.5.1
gx/v3.5.2
gx/v3.5.3
gx/v3.5.4
gx/v3.6.0
gx/v4.*
gx/v4.0.0
gx/v4.0.1
gx/v4.0.2
gx/v4.0.3
gx/v4.0.4
gx/v4.1.0
gx/v4.2.0
gx/v4.3.0
gx/v4.3.1
gx/v4.3.10
gx/v4.3.11
gx/v4.3.12
gx/v4.3.2
gx/v4.3.3
gx/v4.3.4
gx/v4.3.5
gx/v4.3.6
gx/v4.3.7
gx/v4.3.8
gx/v4.3.9
gx/v4.4.0
gx/v4.4.1
gx/v4.4.2
gx/v4.4.3
gx/v4.4.4
gx/v4.4.5
gx/v4.5.0
gx/v4.5.1
gx/v4.5.2
gx/v4.5.3
gx/v4.5.4
gx/v4.5.5
gx/v5.*
gx/v5.0.0
gx/v5.0.1
gx/v5.0.10
gx/v5.0.11
gx/v5.0.12
gx/v5.0.13
gx/v5.0.14
gx/v5.0.15
gx/v5.0.16
gx/v5.0.17
gx/v5.0.18
gx/v5.0.19
gx/v5.0.2
gx/v5.0.20
gx/v5.0.21
gx/v5.0.3
gx/v5.0.4
gx/v5.0.5
gx/v5.0.6
gx/v5.0.7
gx/v5.0.8
gx/v5.0.9
gx/v6.*
gx/v6.0.0
gx/v6.0.1
gx/v6.0.10
gx/v6.0.11
gx/v6.0.12
gx/v6.0.13
gx/v6.0.14
gx/v6.0.15
gx/v6.0.16
gx/v6.0.17
gx/v6.0.18
gx/v6.0.19
gx/v6.0.2
gx/v6.0.20
gx/v6.0.21
gx/v6.0.22
gx/v6.0.23
gx/v6.0.29
gx/v6.0.3
gx/v6.0.4
gx/v6.0.5
gx/v6.0.6
gx/v6.0.7
gx/v6.0.8
gx/v6.0.9
v0.*
v0.0.1
v0.0.10
v0.0.11
v0.0.12
v0.0.13
v0.0.14
v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.2
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.27
v0.0.28
v0.0.29
v0.0.3
v0.0.30
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.2
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.15.0-rc.1
v0.16.0
v0.16.0-dev
v0.17.0
v0.18.0
v0.18.0-rc1
v0.18.0-rc2
v0.18.0-rc3
v0.18.0-rc4
v0.18.0-rc5
v0.18.0-rc6
v0.19.0
v0.2.0
v0.2.1
v0.20.0
v0.21.0
v0.21.0-rc
v0.22.0
v0.23.0
v0.23.1
v0.23.2
v0.24.0
v0.24.0-dev
v0.24.1
v0.24.2
v0.25.0
v0.25.1
v0.26.0
v0.26.1
v0.27.0
v0.27.1
v0.28.0
v0.28.1
v0.29.0
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v0.9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39533.json"