Improper input validation in Ipld Go-Ipld-Prime
CVE-2023-22460
go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.011 (63.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 63rd percentile — 63.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.011 · change: +0.001
Affected products
- Ipld Go-Ipld-Prime — versions < 0.19.0
- Protocol Go-Ipld-Prime
Weakness classification (CWE)
References
- github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92 (Third Party Advisory)
- github.com/ipld/go-ipld-prime/pull/472 (Patch, Third Party Advisory)
- github.com/ipld/go-ipld-prime/releases/tag/v0.19.0 (Third Party Advisory, Release Notes)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2023-22460?
- CVE-2023-22460 is a high-severity vulnerability in Ipld Go-Ipld-Prime, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2023-01-04.
- How severe is CVE-2023-22460?
- High severity. CVSS v3 base score is 7.5 out of 10.