Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/ipld/go-ipfs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    Daemon panics when processing certain blocks

    GHSA-mcq2-w56r-5w2w

    Affected
    • Go github.com/ipld/go-ipfs >= 0.12.0, < 0.12.2; < 0.11.1
    Fixed in
    0.11.10.12.2· Vendor fix available
    Issue
    Impact go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks. This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs. Patches Versions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration. For those running on forked versions of go-ipfs or who are on v0.10.0 and…

    Recommended action: Upgrade to 0.12.2 or 0.11.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →