CVE-2023-22460: Improper Input Validation

go-ipld-prime is an implementation of the InterPlanetary Linked Data IPLD spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON...

PT-2023-18513

Name of the Vulnerable Software and Affected Versions go-ipld-prime versions prior to 0.19.0 Description The issue arises when encoding data that contains a Bytes kind Node using the json codec, causing the encoder to panic as it does not expect to receive Bytes tokens. This should be treated as ...

Go-IPLD-Prime input validation vulnerability

go-ipld-prime is an IPLD open source implementation of the ipld specification interface. A input validation error vulnerability exists in go-ipld-prime, which stems from the fact that its encoded data containing Bytes class nodes will pass a Bytes token to the JSON encoder, since it does not expe...

CVE-2022-2584 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb

The dag-pb codec can panic when decoding invalid blocks...

CVE-2022-23495

go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode...

GO-2022-0503 Denial of service via malformed CAR data in github.com/ipld/go-car and go-car/v2

Decoding malformed CAR data can cause panics or excessive memory usage...

Denial Of Service (DoS)

github.com/ipld/go-car is vulnerable to denial of service. The vulnerability exists in LdRead function in util.go because the decoding of CAR data is not properly handled which leads to an excessive memory usage causing an application crash...

Malformed CAR panics and excessive memory usage

Impact Versions impacted = [email protected] = [email protected] Description of user-facing changes...

GO-2022-0422 Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb

The dag-pb codec can panic when decoding invalid blocks...

GHSA-G3VV-G2J5-45F2 ipld/go-codec-dagpb panics when processing certain blocks

Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec go-codec-dagpb can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread. Patches The issue is...

arc-swap (>=0.3.1, <=0.4.5), ipld-collections (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2020-36460 via model (>=0.0.4, <=0.1.2)

model CARGO version =0.0.4, =0.3.1, =0.1.0, =0.13.0, =0.0.1, =0.1.5 Source cves: CVE-2020-36460 Source advisory: GHSA-MXV6-Q98X-H958...

arc-swap (>=0.3.1, <=0.4.5), ipld-collections (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2020-36460 via model (>=0.0.4, <=0.1.2)

model CARGO version =0.0.4, =0.3.1, =0.1.0, =0.13.0, =0.0.1, =0.1.5 Source cves: CVE-2020-36460 Source advisory: OSV:GHSA-MXV6-Q98X-H958...

arc-swap (>=0.3.1, <=0.4.5), ipld-collections (>=0.1.0, <=0.3.0) +2 more potentially affected by CVE-2020-36460 via model (>=0.0.4, <=0.1.2)

model CARGO version =0.0.4, =0.3.1, =0.1.0, =0.13.0, =0.0.1, =0.1.5 Source cves: CVE-2020-36460 Source advisory: OSV:RUSTSEC-2020-0140...