PT-2023-18513 · Unknown · Go-Ipld-Prime

Hacdias · Published 2023-01-04 · Updated 2023-01-18 · CVE-2023-22460

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-ipld-prime versions prior to 0.19.0

Description The issue arises when encoding data that contains a Bytes kind Node using the json codec, causing the encoder to panic as it does not expect to receive Bytes tokens. This should be treated as an error since plain JSON cannot encode bytes. The dag-json codec is not impacted, and neither is the use of json as a decoder. If the json codec is used to encode user-supplied data, it may be used as a vector for a denial of service attack.

Recommendations For versions prior to 0.19.0, update to version 0.19.0 to resolve the issue. As a temporary workaround, consider using the dag-json codec, which has the ability to encode bytes, instead of the json codec for encoding data that contains Bytes kind Nodes.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-22460

GHSA-C653-6HHG-9X92

GO-2023-1269

Affected Products

Go-Ipld-Prime

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22460.json · Exploit
• https://github.com/ipld/go-ipld-prime/pull/472 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-22460 · Security Note
• https://osv.dev/vulnerability/CVE-2023-22460 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1269 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c653-6hhg-9x92 · Vendor Advisory
• https://github.com/ipld/go-ipld-prime · Note
• https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92 · Note
• https://github.com/ipld/go-ipld-prime/commit/146d1c8529676fe9ee0604f014656af2395505fc · Note
• https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0 · Note
• https://t.me/cibsecurity/55898 · Telegram Post
• https://pkg.go.dev/vuln/GO-2023-1269 · Note