PT-2022-17563 · Unknown · Go-Codec-Dagpb

Published 2022-04-08 · Updated 2023-01-06 · CVE-2022-2584

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-codec-dagpb versions prior to 1.3.1

Description The dag-pb codec can panic when decoding invalid blocks, due to an assumption that the reported link length is accurate. If the block ends before the reported length, it results in a buffer overread.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or above to resolve the issue. As a temporary workaround, consider recovering panics higher in the call stack of the goroutine that calls the defective code.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2022-2584

GHSA-967G-CJX4-H7J6

GHSA-G3VV-G2J5-45F2

GO-2022-0422

Affected Products

Go-Codec-Dagpb

References · 10

• https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57 · Patch
• https://osv.dev/vulnerability/GHSA-967g-cjx4-h7j6 · Vendor Advisory
• https://pkg.go.dev/vuln/GO-2022-0422 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2584 · Security Note
• https://osv.dev/vulnerability/GO-2022-0422 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2584 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3vv-g2j5-45f2 · Vendor Advisory
• https://github.com/ipld/go-codec-dagpb/security/advisories/GHSA-g3vv-g2j5-45f2 · Note
• https://t.me/cvenotify/40822 · Telegram Post
• https://t.me/cibsecurity/55441 · Telegram Post