Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.
Recommended action: Upgrade to 0.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTTP RPC API v0/dag/import endpoint. An attacker controlling the car file passed in can also make the node allocate arbitrary sized buffers creating memory exhaustion attacks. Patches 0.13.1, 0.14 and later. Forks For those running on forked versions of go-ipfs, simply updating the version of github.com/ipld/go-car/v2 you are using to = v2.4.0 should resolve the issue. Libraries consumers Any users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-car. You can check if your Go module has a dependency on go-car by running a command such as go mod graph | grep go-car in your module root. Note: if you are using…
Recommended action: Upgrade to 0.13.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Allows admin API access to the IPFS node. Who ? This affects people running the docker-compose.yaml service in an environment where the docker host is directly attached to a public or untrusted IP. In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as 0.0.0.0:5001 on the host machine. If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT. That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall. Patches This issue is in docker-compose.yaml. Users need to replace their current docker-compose.yaml file with a version 0.12.1 or later. There is no need to update any of the binaries. Users running previous versions like 0.12.0 or earlier can download the 0.12.1 docker-compose.yaml file. You can replace a vulnerable docker-compose.yaml file with a the…
Recommended action: Upgrade to 0.12.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when ipfs get is done on an affected DAG. 1. The only affected command is ipfs get. 2. The gateway is not affected. Patches Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227 tar-utils patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2 Workarounds Upgrade to go-ipfs 0.8 or later. References Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs For more information If you have any questions or comments about this advisory: Open an issue in go-ipfs Email us at security@ipfs.io
Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. Patches <!-- Has the problem been patched? What versions should users upgrade to? -- - Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0 For more information If you have any questions or comments about this advisory: Open an issue in go-ipfs Email us at security@ipfs.io
Recommended action: Upgrade to 0.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.