Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/ipfs/go-merkledag

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    go-merkledag's ProtoNode may be modified such that common method calls may panic

    CVE-2022-23495 · GHSA-x39j-h85h-3f46

    Affected
    • Go github.com/ipfs/go-merkledag >= 0.4.0, < 0.8.1
    Fixed in
    0.8.1· Vendor fix available
    Issue
    Impact A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns. A ProtoNode should only be able to encode to valid DAG-PB, attempting to encode invalid DAG-PB forms will result in an error from the codec. Manipulation of an existing (newly created or decoded) ProtoNode using the modifier methods did not account for certain states that would place the ProtoNode into an unencodeable form. Due to conformance with the github.com/ipfs/go-block-format#Block and github.com/ipfs/go-ipld-format#Node interfaces, certain methods, which internally require a re-encode if state has changed, will panic due to the inability to return an error. Additionally, use of the ProtoNode#SetCidBuilder() method to set a non-functioning CidBuilder (such as one that refers to a multihash where an implementation of that hash function is not available) may cause the same methods to panic as a new CID is…

    Recommended action: Upgrade to 0.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →