GitHub Advisoryadvisory · Go

GHSA-r23h-3jmw-q7hr Access Restriction Bypass in go-ipfs

HIGH Published 2024-04-24 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-10937
Ecosystem
Go
Packages
github.com/ipfs/go-ipfs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-284
Reviewed
2024-04-24

Affected packages

• Go github.com/ipfs/go-ipfs: < 0.7.0 → fixed in 0.7.0

Description

An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.

Related

Alias · CVE (1)

  • CVE-2020-10937 An issue was discovered in IPFS (aka go-ipfs) 0.4.23. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References