GO-2022-0503 Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2

Decoding malformed CAR data can cause panics or excessive memory usage...

WS-2022-0172

Versions impacted "=" [email protected] "=" [email protected] Description Decoding CAR data from untrusted user input can cause: - Panics: - Out of bound memory access - Out of memory - Divide by zero - Excessive memory usage Such panics can be triggered by intentionally malformed CARv1 data, including...

Denial Of Service (DoS)

github.com/ipld/go-car is vulnerable to denial of service. The vulnerability exists in LdRead function in util.go because the decoding of CAR data is not properly handled which leads to an excessive memory usage causing an application crash...

DOS and excessive memory usage when passing untrusted user input to to dag import

Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTTP RPC API...

Malformed CAR panics and excessive memory usage

Impact Versions impacted = [email protected] = [email protected] Description of user-facing changes...

PT-2022-28237

Name of the Vulnerable Software and Affected Versions go-ipfs versions prior to 0.13.1 go-ipfs version 0.14 and later are not affected, but versions prior to 0.14 may be vulnerable if they use a vulnerable version of go-car Description The issue is caused by a problem in the go-car dependency,...