HIGH
GHSA-wc36-xgcc-jwpr
Failure to verify the public key of a `SignedEnvelope` against the `PeerId` in a `PeerRecord`
Details
Affected versions of this crate did not check that the public key the signature was created with matches the peer ID of the peer record. Any combination was considered valid.
This allows an attacker to republish an existing `PeerRecord` with a different `PeerId`.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/libp2p-core
Introduced in:
0.30.0-rc.1Fixed in: 0.30.2Upgrade libp2p-core to 0.30.2 or newer (ecosystem crates.io).