CVE-2023-23625
Medium
Description
go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus `fanout` parameter in the HAMT directory nodes. Users are advised to upgrade to version 0.4.3 to resolve this issue. Users unable to upgrade should not feed untrusted user data to the decoding functions.
SeverityMedium
CVSS5.9
Exploit probability—
ProductProtocol Go-unixfs
PublishedFeb 9, 2023
First seenFeb 9, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- protocol go-unixfs0.4.3 or later
- github.com/ipfs/go-unixfs0.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| protocol go-unixfs | v < 0.4.3 | 0.4.3 |
| github.com/ipfs/go-unixfsGo | v < 0.4.3 | 0.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.