GO-2023-1559

    Dashboard / Vulnerabilities / GO-2023-1559

    GO-2023-1559

    Published: 14 Feb 2023Last Modified: 20 May 2024

    Summary: Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfsnode

    Details: Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by a bogus fanout parameter in the HAMT directory nodes. There are no known workarounds (users are advised to upgrade).

    References: https://github.com/ipfs/go-unixfsnode/security/advisories/GHSA-4gj3-6r43-3wfc, https://github.com/ipfs/go-unixfsnode/commit/59050ea8bc458ae55246ae09243e6e165923e076

    Affected packages

    Package

    Name: github.com/ipfs/go-unixfsnode

    Purl: pkg:golang/github.com/ipfs/go-unixfsnode

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.5.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High