github libp2p/rust-libp2p v0.30.0
Version 0.30.0 [2020-11-09]

latest releases: v0.54.1, libp2p-v0.54.0, libp2p-webrtc-v0.7.1-alpha...
3 years ago

Among other changes, this release adds a requirement across all crates for multihash >= v0.11.3. Rust-libp2p versions in combination with multihash < v0.11.3 are vulnerable to DoS attacks. Given that e.g. PeerId::from_bytes is called with unsanitized data from possibly untrusted sources this call can panic with multihash < v0.11.3 see RustSec for details.

In case you run libp2p in untrusted environments please either (a) update to libp2p v0.30.0 or (b) make sure to run with multihash >=v0.11.3 via your downstream Cargo.lock file.

As always all other contained changes are listed in our CHANGELOG.md.

Don't miss a new rust-libp2p release

NewReleases is sending notifications on new releases.