GHSA-wc36-xgcc-jwpr
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.
This allows an attacker to republish an existing PeerRecord with a different PeerId.
What each source reports
GitHub AdvisoriesNo score
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.
This allows an attacker to republish an existing PeerRecord with a different PeerId.
- Record
GHSA-wc36-xgcc-jwpr- Updated
- 2026-11-02
OSVNo score
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.
This allows an attacker to republish an existing PeerRecord with a different PeerId.
- Record
GHSA-wc36-xgcc-jwpr- Updated
- 2026-11-02
OSVRUSTSEC-2022-0009No score
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.
This allows an attacker to republish an existing PeerRecord with a different PeerId.
- Record
RUSTSEC-2022-0009- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libp2p-corecrates.io | 0.30.0-rc.1 up to 0.30.2 | 0.30.2 |
libp2p-corecrates.io | 0.30.0-rc.1 up to 0.30.2, 0.31.0-0 up to 0.31.1 | 0.30.20.31.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-wc36-xgcc-jwpr is a vulnerability with no CVSS score yet in libp2p-core, published February 7, 2022. No source lists public exploit code. Fixed in libp2p-core 0.30.2.