GitHub Advisoryadvisory · Go

GHSA-r4gv-vj59-cccm Control character injection in console output in github.com/ipfs/go-ipfs

MEDIUM Published 2021-06-23 Modified 2021-05-21 Official page ↗
Aliases
CVE-2020-26283
Ecosystem
Go
Packages
github.com/ipfs/go-ipfs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Weaknesses
CWE-116, CWE-150
Reviewed
2021-05-21

Affected packages

• Go github.com/ipfs/go-ipfs: < 0.8.0 → fixed in 0.8.0

Description

Impact Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. Patches • Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0 For more information If you have any questions or comments about this advisory: • Open an issue in go-ipfs • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2020-26283 go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References