Releases: libp2p/rust-libp2p
Releases · libp2p/rust-libp2p
v0.39.1
v0.38.0
v0.37.1
v0.36.0
Version 0.30.0 [2020-11-09]
v0.30.0
This tag was signed with the committer’s verified signature.
The key has expired.
mxinden
Max Inden
fabb00c
This commit was signed with the committer’s verified signature.
The key has expired.
mxinden
Max Inden
Among other changes, this release adds a requirement across all crates for multihash >= v0.11.3. Rust-libp2p versions in combination with multihash < v0.11.3 are vulnerable to DoS attacks. Given that e.g. PeerId::from_bytes is called with unsanitized data from possibly untrusted sources this call can panic with multihash < v0.11.3 see RustSec for details.
In case you run libp2p in untrusted environments please either (a) update to libp2p v0.30.0 or (b) make sure to run with multihash >=v0.11.3 via your downstream Cargo.lock file.
As always all other contained changes are listed in our CHANGELOG.md.