Lucene search

K
osvGoogleOSV:GO-2022-1155
HistoryDec 22, 2022 - 5:41 p.m.

Panic in github.com/ipfs/go-merkledag

2022-12-2217:41:44
Google
osv.dev
17
protonode
modify
encode errors
panic
method calls
cidbuilder
github

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

64.6%

A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don’t allow for error returns.

Additionally, use of the ProtoNode.SetCidBuilder() method to set non-functioning CidBuilder (such as one that refers to a multihash where an implementation of that hash function is not available) may cause the same methods to panic as a new CID is required but cannot be created.

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.002 Low

EPSS

Percentile

64.6%

Related for OSV:GO-2022-1155