GO-2023-1557

    Dashboard / Vulnerabilities / GO-2023-1557

    GO-2023-1557

    Published: 14 Feb 2023Last Modified: 20 May 2024

    Summary: Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs

    Details: Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus "fanout" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to the decoding functions.

    References: https://github.com/advisories/GHSA-q264-w97q-q778, https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175

    Affected packages

    Package

    Name: github.com/ipfs/go-unixfs

    Purl: pkg:golang/github.com/ipfs/go-unixfs

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.4.3

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High