CVE-2023-23631
Medium
Description
github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.
SeverityMedium
CVSS5.9
Exploit probability—
ProductProtocol Go-unixfsnode
PublishedFeb 9, 2023
First seenFeb 9, 2023
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- protocol go-unixfsnode1.5.2 or later
- github.com/ipfs/go-unixfsnode1.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| protocol go-unixfsnode | v < 1.5.2 | 1.5.2 |
| github.com/ipfs/go-unixfsnodeGo | v < 1.5.2 | 1.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.