Detections
Analytics

SCA: security update for libp2p (GHSA-f44q-634c-jvwv)

high Tenable Self-Hosted Container Security Plugin ID 414244

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than
 `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target
 libp2p’s connection, stream, peer, and memory management. An attacker can cause the allocation of large
 amounts of memory, ultimately leading to the process getting killed by the host’s operating system. While
 a connection manager tasked with keeping the number of connections within manageable limits has been part
 of js-libp2p, this component was designed to handle the regular churn of peers, not a targeted resource
 exhaustion attack. Users are advised to update their js-libp2p dependency to `v0.38.0` or greater. There
 are no known workarounds for this vulnerability. (CVE-2022-23487)

See Also

https://github.com/advisories/GHSA-f44q-634c-jvwv

Plugin Details

Severity: High

ID: 414244

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2022-23487

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/7/2022

Vulnerability Publication Date: 12/7/2022

Reference Information

CVE: CVE-2022-23487