GHSA-c653-6hhg-9x92

Suggest an improvement
Source
https://github.com/advisories/GHSA-c653-6hhg-9x92
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-c653-6hhg-9x92/GHSA-c653-6hhg-9x92.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-c653-6hhg-9x92
Aliases
Related
Published
2023-01-05T12:04:09Z
Modified
2023-11-08T04:11:35.552164Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
go-ipld-prime/codec/json may panic if asked to encode bytes
Details

go-ipld-prime is a series of Go interfaces for manipulating IPLD data and a Go module that contains the go-ipld-prime/codec/json codec.

Impact

Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encoding should be treated as an error, as plain JSON should not be able to encode Bytes.

This only impacts uses of the "json" codec, "dag-json" is not impacted. Use of "json" as a decoder is not impacted.

Patches

Fixed in v0.19.0.

Workarounds

Prefer the "dag-json" codec which has the ability to encode bytes.

References

See fix in #472

Database specific 
{
    "nvd_published_at": "2023-01-04T15:15:00Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-05T12:04:09Z"
}
References

Affected packages

Go / github.com/ipld/go-ipld-prime

Package

Name
github.com/ipld/go-ipld-prime
View open source insights on deps.dev
Purl
pkg:golang/github.com/ipld/go-ipld-prime

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.19.0