x/vulndb: potential Go vuln in github.com/libp2p/go-libp2p: CVE-2023-39533

[GoVulnBot]

CVE-2023-39533 references github.com/libp2p/go-libp2p, which may be a Go module.

Description:
go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run a resource exhaustion attack & force a node to spend time doing signature verification of the large key. This vulnerability is present in the core/crypto module of go-libp2p and can occur during the Noise handshake and the libp2p x509 extension verification step. To prevent this attack, go-libp2p versions 0.27.8, 0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's application, it is necessary to update to these patch releases and to use the updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-39533
• JSON: https://github.com/CVEProject/cvelist/tree/4418488d64b3b928a61a9be50b08a6c68fdcd8bd/2023/39xxx/CVE-2023-39533.json
• advisory: GHSA-876p-8259-xjgg
• report: https://go.dev/issue/61460
• fix: core/crypto: restrict RSA keys to <= 8192 bits libp2p/go-libp2p#2454
• fix: update qtls to restrict RSA keys in certificates to <= 8192 bits quic-go/quic-go#4012
• fix: https://go.googlesource.com/+/2350afd2e8ab054390e284c95d5b089c142db017
• fix: libp2p/go-libp2p@0cce607
• fix: libp2p/go-libp2p@445be52
• fix: libp2p/go-libp2p@e30fcf7
• Imported by: https://pkg.go.dev/github.com/libp2p/go-libp2p?tab=importedby

Cross references:

• Module github.com/libp2p/go-libp2p appears in issue x/vulndb: potential Go vuln in github.com/libp2p/go-libp2p: GHSA-j7qp-mfxf-8xjw #1148

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/libp2p/go-libp2p
      vulnerable_at: 0.29.2
      packages:
        - package: go-libp2p
description: |-
    go-libp2p is the Go implementation of the libp2p Networking Stack. Prior to
    versions 0.27.8, 0.28.2, and 0.29.1 malicious peer can use large RSA keys to run
    a resource exhaustion attack & force a node to spend time doing signature
    verification of the large key. This vulnerability is present in the core/crypto
    module of go-libp2p and can occur during the Noise handshake and the libp2p x509
    extension verification step. To prevent this attack, go-libp2p versions 0.27.8,
    0.28.2, and 0.29.1 restrict RSA keys to <= 8192 bits. To protect one's
    application, it is necessary to update to these patch releases and to use the
    updated Go compiler in 1.20.7 or 1.19.12. There are no known workarounds for
    this issue.
cves:
    - CVE-2023-39533
references:
    - advisory: https://github.com/libp2p/go-libp2p/security/advisories/GHSA-876p-8259-xjgg
    - report: https://go.dev/issue/61460
    - fix: https://github.com/libp2p/go-libp2p/pull/2454
    - fix: https://github.com/quic-go/quic-go/pull/4012
    - fix: https://go.googlesource.com/+/2350afd2e8ab054390e284c95d5b089c142db017
    - fix: https://github.com/libp2p/go-libp2p/commit/0cce607219f3710addc7e18672cffd1f1d912fbb
    - fix: https://github.com/libp2p/go-libp2p/commit/445be526aea4ee0b1fa5388aa65d32b2816d3a00
    - fix: https://github.com/libp2p/go-libp2p/commit/e30fcf7dfd4715ed89a5e68d7a4f774d3b9aa92d

[gopherbot]

Change https://go.dev/cl/517435 mentions this issue: data/reports: add GO-2023-2000.yaml