GO-2023-1557

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2023-1557

Import Source

https://vuln.go.dev/ID/GO-2023-1557.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2023-1557

Aliases

Published

2023-02-14T19:34:46Z

Modified

2024-05-20T16:03:47Z

Summary

Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs

Details

Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by bogus "fanout" parameter in the HAMT directory nodes. A workaround is to not feed untrusted user data to the decoding functions.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2023-1557",
    "review_status": "REVIEWED"
}

References

Credits

- Jorropo

Affected packages

Go / github.com/ipfs/go-unixfs

Package

Name: github.com/ipfs/go-unixfs; View open source insights on deps.dev
Purl: pkg:golang/github.com/ipfs/go-unixfs

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.4.3

Ecosystem specific

{
    "imports": [
        {
            "path": "github.com/ipfs/go-unixfs/hamt",
            "symbols": [
                "NewHamtFromDag",
                "NewShard",
                "NewShardValue",
                "Shard.EnumLinks",
                "Shard.EnumLinksAsync",
                "Shard.Find",
                "Shard.ForEachLink",
                "Shard.Remove",
                "Shard.Set",
                "Shard.SetLink",
                "Shard.Swap",
                "Shard.Take",
                "makeShard",
                "newChilder"
            ]
        }
    ]
}