PT-2021-11230 · Go-Ipfs · Go-Ipfs

Tintinweb · Published 2021-03-24 · Updated 2024-08-21 · CVE-2020-26279

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: go-ipfs versions prior to 0.8.0-rc1

Description: The issue is related to path traversal in go-ipfs, which can occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG.

Recommendations: For go-ipfs versions prior to 0.8.0-rc1, upgrade to go-ipfs 0.8 or later to resolve the issue. As a temporary workaround, consider avoiding the use of ipfs get on affected DAGs until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-26279

GHSA-27PV-Q55R-222G

GO-2022-0779

Affected Products

Go-Ipfs

References · 8

• https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2 · Patch
• https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26279 · Security Note
• https://osv.dev/vulnerability/GO-2022-0779 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26279 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27pv-q55r-222g · Vendor Advisory
• https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222g · Note
• https://t.me/cvenotify/12100 · Telegram Post