GitHub Advisoryadvisory · Go

GHSA-g3vv-g2j5-45f2 ipld/go-codec-dagpb panics when processing certain blocks

HIGH Published 2022-04-08 Modified 2026-01-23 Official page ↗
Aliases
CVE-2022-2584
Ecosystem
Go
Packages
github.com/ipld/go-codec-dagpb
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-119
Reviewed
2022-04-08

Affected packages

• Go github.com/ipld/go-codec-dagpb: < 1.3.1 → fixed in 1.3.1

Description

Impact Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic. The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread. Patches The issue is fixed in v1.3.1 and above. Consumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root: ```go mod graph | grep go-codec-dagpb``` Workarounds You can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code. For more information If you have any questions or comments about this advisory: • Ask in IPFS Discord #ipld-chatter • Open an issue in go-codec-dagpb

Related

Alias · CVE (1)

  • CVE-2022-2584 The dag-pb codec can panic when decoding invalid blocks. vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References