GHSA-r23h-3jmw-q7hr

Source

https://github.com/advisories/GHSA-r23h-3jmw-q7hr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-r23h-3jmw-q7hr/GHSA-r23h-3jmw-q7hr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r23h-3jmw-q7hr

Aliases

CVE-2020-10937
GO-2024-2779

Published

2024-04-24T20:01:46Z

Modified

2024-06-04T16:58:36.019950Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Access Restriction Bypass in go-ipfs

Details

An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.

Database specific

{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-24T20:01:46Z"
}

References

Affected packages

Go / github.com/ipfs/go-ipfs

Package

Name: github.com/ipfs/go-ipfs; View open source insights on deps.dev
Purl: pkg:golang/github.com/ipfs/go-ipfs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.7.0