ipfs vulnerabilities

Products

• github.com/ipfs/go-ipfs 5
• github.com/ipfs/go-bitswap 2
• AEgir 1
• boxo 1
• github.com/ipfs/go-bitfield 1
• github.com/ipfs/go-libipfs 1
• github.com/ipfs/go-merkledag 1
• github.com/ipfs/go-unixfs 1
• github.com/ipfs/go-unixfsnode 1
• github.com/ipfs/kubo 1
• go-ipfs-dep 1

Latest ipfs CVEs

Newest publication first

1. GHSA-qvqg-6rp8-4p9h github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak

   Published 2023-05-11

   Medium·CVSS 5.3

   Impact An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many WANT_BLOCK and or WANT_HAVE requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed. This affects users accepting or connecting...

2. GHSA-q3j6-22wf-3jh9 github.com/ipfs/go-bitswap vulnerable to DOS unbounded persistent memory leak

   Published 2023-05-11

   High·CVSS 7.5

   This package has been moved to github.com/ipfs/boxo/bitswap, this vulnerability is tracked there: https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 (CVE-2023-25568) Remediation This is a two step process: Apply one of: (recommended) upgrade from github.com/ipfs...

3. CVE-2023-25568 Boxo bitswap/server: DOS unbounded persistent memory leak

   Published 2023-05-10

   High·CVSS 7.5 EPSS 0.86%

   Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affec...

4. CVE-2023-23625 Denial of service in HAMT Decoding in go-unixfs

   Published 2023-02-09

   High·CVSS 7.5 EPSS 0.68%

   go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag. Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted user input, an attacker can then trigger a panic. This is caused by bogu...

5. CVE-2023-23626 Denial of service when feeding malformed size arguments in go-bitfield

   Published 2023-02-09

   High·CVSS 7.5 EPSS 0.91%

   go-bitfield is a simple bitfield package for the go language aiming to be more performant that the standard library. When feeding untrusted user input into the size parameter of NewBitfield and FromBytes functions, an attacker can trigger panics. This happen when the size is a no...

6. CVE-2023-23631 HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

   Published 2023-02-09

   High·CVSS 7.5 EPSS 0.91%

   github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing. In versions priot to 1.5.2 trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks. If you are reading untrusted u...

7. CVE-2022-23495 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag

   Published 2022-12-08

   High·CVSS 7.5 EPSS 1.4%

   go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A ProtoNode may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't allow for error returns...

8. GHSA-f2gr-7299-487h DOS and excessive memory usage when passing untrusted user input to to dag import

   Published 2022-07-06

   Unknown

   Impact go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint. This include the corresponding HTT...

9. GHSA-fx5p-f64h-93xc Opened exploitable ports in default docker-compose.yaml in go-ipfs

   Published 2022-04-04

   Unknown

   Impact Allows admin API access to the IPFS node. Who ? This affects people running the docker-compose.yaml service in an environment where the docker host is directly attached to a public or untrusted IP. In the vulnerable version, the private API endpoint is publicly forwarded b...

10. CVE-2020-26283 Control character injection in console output

    Published 2021-03-24

    High·CVSS 8.8 EPSS 1.5%

    go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user tak...

11. CVE-2020-26279 Path traversal

    Published 2021-03-24

    High·CVSS 8.1 EPSS 1.7%

    go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwrit...

12. CVE-2020-10937 Access Restriction Bypass in go-ipfs

    Published 2020-11-02

    High·CVSS 7.5 EPSS 1.2%

    An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of...

13. CVE-2020-11059 Exposure of Sensitive Information to an Unauthorized Actor in AEgir

    Published 2020-05-27

    High·CVSS 7.5 EPSS 1.1%

    In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.

14. CVE-2016-10563 Downloads Resources over HTTP in go-ipfs-dep

    Published 2018-05-31

    High·CVSS 8.1 EPSS 0.75%

    During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP. This allows for a MITM attack to compromise the integrity of the resources used by this module and could allow for further compromise.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.