PT-2022-16028 · Unknown · Go-Merkledag
Mrd0Ll4R
·
Published
2022-12-08
·
Updated
2022-12-22
·
CVE-2022-23495
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
go-merkledag versions prior to 0.8.1
Description
A
ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error from the codec. Manipulation of an existing ProtoNode using the modifier methods did not account for certain states that would place the ProtoNode into an unencodeable form. Due to conformance with the interfaces, certain methods will panic due to the inability to return an error. Additionally, use of the ProtoNode.SetCidBuilder() method to set a non-functioning CidBuilder may cause the same methods to panic as a new CID is required but cannot be created.Recommendations
To resolve the issue, upgrade to version 0.8.1 for a complete set of fixes.
For users unable to upgrade, consider sanitising inputs when allowing user-input to set a new
CidBuilder on a ProtoNode and sanitising Tsize (Link#Size) values such that they are a reasonable byte-size for sub-DAGs where derived from user-input.Exploit
Fix
Unchecked Return Value
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Go-Merkledag