GHSA-mqr9-hjr8-2m9w

Source

https://github.com/advisories/GHSA-mqr9-hjr8-2m9w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/10/GHSA-mqr9-hjr8-2m9w/GHSA-mqr9-hjr8-2m9w.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-mqr9-hjr8-2m9w

Aliases

CVE-2023-26248
GO-2024-3218

Published

2024-10-25T18:30:49Z

Modified

2024-12-12T18:00:00Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse

Details

The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.

Database specific

{
    "nvd_published_at": "2024-10-25T16:15:09Z",
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-25T19:59:06Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-352"
    ]
}

References

Affected packages

Go / github.com/libp2p/go-libp2p-kad-dht

Package

Name: github.com/libp2p/go-libp2p-kad-dht; View open source insights on deps.dev
Purl: pkg:golang/github.com/libp2p/go-libp2p-kad-dht

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.20.0