GHSA-c653-6hhg-9x92

Source

https://github.com/advisories/GHSA-c653-6hhg-9x92

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-c653-6hhg-9x92/GHSA-c653-6hhg-9x92.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c653-6hhg-9x92

Aliases

Published

2023-01-05T12:04:09Z

Modified

2023-11-08T04:11:35.552164Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

go-ipld-prime/codec/json may panic if asked to encode bytes

Details

go-ipld-prime is a series of Go interfaces for manipulating IPLD data and a Go module that contains the go-ipld-prime/codec/json codec.

Impact

Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encoding should be treated as an error, as plain JSON should not be able to encode Bytes.

This only impacts uses of the "json" codec, "dag-json" is not impacted. Use of "json" as a decoder is not impacted.

Patches

Fixed in v0.19.0.

Workarounds

Prefer the "dag-json" codec which has the ability to encode bytes.

References

See fix in #472

Database specific

{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-20"
    ],
    "nvd_published_at": "2023-01-04T15:15:00Z",
    "github_reviewed_at": "2023-01-05T12:04:09Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/ipld/go-ipld-prime

Package

Name: github.com/ipld/go-ipld-prime; View open source insights on deps.dev
Purl: pkg:golang/github.com/ipld/go-ipld-prime

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.19.0