x/vulndb: potential Go vuln in github.com/libp2p/go-libp2p: CVE-2023-40583

[GoVulnBot]

CVE-2023-40583 references github.com/libp2p/go-libp2p, which may be a Go module.

Description:
libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This memory does not get garbage collected and so the victim can run out of memory and crash. If users of go-libp2p in production are not monitoring memory consumption over time, it could be a silent attack i.e. the attacker could bring down nodes over a period of time (how long depends on the node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory takes about 90 sec to bring down; on a larger server, it might take a bit longer.) This issue was patched in version 0.27.4.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-40583
• JSON: https://github.com/CVEProject/cvelist/tree/335b611128969027a04abca51d8b35cb44692055/2023/40xxx/CVE-2023-40583.json
• advisory: GHSA-gcq9-qqwx-rgj3
• fix: libp2p/go-libp2p@45d3c6f
• web: https://github.com/libp2p/go-libp2p/releases/tag/v0.27.4
• web: https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7
• Imported by: https://pkg.go.dev/github.com/libp2p/go-libp2p?tab=importedby

Cross references:

• Module github.com/libp2p/go-libp2p appears in issue x/vulndb: potential Go vuln in github.com/libp2p/go-libp2p: GHSA-j7qp-mfxf-8xjw #1148
• Module github.com/libp2p/go-libp2p appears in issue x/vulndb: potential Go vuln in github.com/libp2p/go-libp2p: CVE-2023-39533 #2000

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/libp2p/go-libp2p
      vulnerable_at: 0.30.0
      packages:
        - package: go-libp2p
description: |-
    libp2p is a networking stack and library modularized out of The IPFS Project,
    and bundled separately for other tools to use. In go-libp2p, by using signed
    peer records a malicious actor can store an arbitrary amount of data in a remote
    node’s memory. This memory does not get garbage collected and so the victim
    can run out of memory and crash. If users of go-libp2p in production are not
    monitoring memory consumption over time, it could be a silent attack i.e. the
    attacker could bring down nodes over a period of time (how long depends on the
    node resources i.e. a go-libp2p node on a virtual server with 4 gb of memory
    takes about 90 sec to bring down; on a larger server, it might take a bit
    longer.) This issue was patched in version 0.27.4.
cves:
    - CVE-2023-40583
references:
    - advisory: https://github.com/libp2p/go-libp2p/security/advisories/GHSA-gcq9-qqwx-rgj3
    - fix: https://github.com/libp2p/go-libp2p/commit/45d3c6fff662ddd6938982e7e9309ad5fa2ad8dd
    - web: https://github.com/libp2p/go-libp2p/releases/tag/v0.27.4
    - web: https://github.com/libp2p/go-libp2p/releases/tag/v0.27.7

[tatianab]

Duplicate of #2024