GHSA-6fcr-9h9g-23fq

Source

https://github.com/advisories/GHSA-6fcr-9h9g-23fq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-6fcr-9h9g-23fq/GHSA-6fcr-9h9g-23fq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6fcr-9h9g-23fq

Published

2020-09-02T21:50:51Z

Modified

2023-12-07T22:08:14Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Denial of Service in ipfs-bitswap

Details

Versions of ipfs-bitswap prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions.

Recommendation

Upgrade to version 0.24.1 or later.

Database specific

{
    "nvd_published_at": null,
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed_at": "2020-08-31T18:40:27Z"
}

References

Affected packages

npm / ipfs-bitswap

Package

Name: ipfs-bitswap; View open source insights on deps.dev
Purl: pkg:npm/ipfs-bitswap

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.24.1