What is CVE-2023-23631?

CVE-2023-23631 is a medium-severity vulnerability in Ipfs Go-Unixfsnode, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2023-02-09.

How severe is CVE-2023-23631?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Resource exhaustion in Ipfs Go-Unixfsnode

CVE-2023-23631

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogus fanout parameter in the HAMT directory nodes. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: DoS (Denial of Service)

EPSS: 0.009 (56.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Ipfs Go-unixfsnode — versions < 1.5.2
Protocol Go-unixfsnode

Weakness classification (CWE)

CWE-400 — Uncontrolled Resource Consumption

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-23631?: CVE-2023-23631 is a medium-severity vulnerability in Ipfs Go-Unixfsnode, classified under Uncontrolled Resource Consumption. CVSS score: 5.9/10. Published 2023-02-09.
How severe is CVE-2023-23631?: Medium severity. CVSS v3 base score is 5.9 out of 10.