PT-2020-21094 · Interplanetary File System · Ipfs-Bitswap

Published 2020-09-02 · Updated 2020-09-02

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ipfs-bitswap versions prior to 0.24.1

Description The issue allows for a Denial of Service (DoS) due to the package putting unwanted blocks in the blockstore, potentially exhausting system resources under specific conditions.

Recommendations Upgrade to version 0.24.1 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

GHSA-6FCR-9H9G-23FQ

Affected Products

Ipfs-Bitswap

References · 5

• https://osv.dev/vulnerability/GHSA-6fcr-9h9g-23fq · Vendor Advisory
• https://github.com/ipfs/js-ipfs-bitswap/pull/194 · Note
• https://github.com/ipfs/js-ipfs-bitswap · Note
• https://npmjs.com/advisories/916 · Note
• https://snyk.io/vuln/SNYK-JS-IPFSBITSWAP-174847 · Note