CVE:CVE-2023-39533
CNNVD:CNNVD-202308-656
go-libp2p是Go中的libp2p实现。
go-libp2p存在安全漏洞，该漏洞源于core/crypto模块存在安全漏洞，攻击者可利用该漏洞迫使节点对大型RSA密钥进行签名验证，导致资源耗尽。受影响的产品和版本：go-libp2p 0.27.8之前版本，0.28.2之前版本，0.29.1之前版本。
solution:Upgrade golang go to a higher version than 1.19.12,1.20.7,and avoid the version (,1.19.12),[1.20.0,1.20.7); Upgrade libp2p go-libp2p to a higher version than 0.27.8,0.28.2,0.29.0,and avoid the version (,0.27.8),[0.28.0,0.28.2),0.29.0; Upgrade quic_project quic to a higher version than 0.37.2,and avoid the version (,0.37.2)