CVE-2022-2584 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb

2022-12-2721:13:51

www.cve.org

cve-2022-2584

github

ipld

panic

decoding

invalid blocks

0.001 Low

EPSS

Percentile

40.9%

JSON

The dag-pb codec can panic when decoding invalid blocks.

CNA Affected

[
  {
    "vendor": "github.com/ipld/go-codec-dagpb",
    "product": "github.com/ipld/go-codec-dagpb",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/ipld/go-codec-dagpb",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.3.1",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "DecodeBytes"
      },
      {
        "name": "Decode"
      },
      {
        "name": "Decoder"
      },
      {
        "name": "Unmarshal"
      }
    ],
    "defaultStatus": "unaffected"
  }
]