data/reports: add GO-2023-1269.yaml
Aliases: CVE-2023-22460, GHSA-c653-6hhg-9x92
Fixes golang/vulndb#1269
Change-Id: I8e1835dd4744caaee023d3aba54fe34ab7f2266a
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/461644
Auto-Submit: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
diff --git a/data/osv/GO-2023-1269.json b/data/osv/GO-2023-1269.json
new file mode 100644
index 0000000..994cbdb
--- /dev/null
+++ b/data/osv/GO-2023-1269.json
@@ -0,0 +1,62 @@
+{
+ "id": "GO-2023-1269",
+ "published": "0001-01-01T00:00:00Z",
+ "modified": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2023-22460",
+ "GHSA-c653-6hhg-9x92"
+ ],
+ "details": "Encoding data using the 'json' codec which contains a 'Bytes' type Node will cause the encoder to panic. The decoder is not impacted. If the codec is used to encode user supplied data, this may be used as a vector for a denial of service attack.",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/ipld/go-ipld-prime",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "0.19.0"
+ }
+ ]
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2023-1269"
+ },
+ "ecosystem_specific": {
+ "imports": [
+ {
+ "path": "github.com/ipld/go-ipld-prime/codec/dagjson",
+ "symbols": [
+ "Encode",
+ "EncodeOptions.Encode",
+ "Marshal"
+ ]
+ }
+ ]
+ }
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92"
+ },
+ {
+ "type": "FIX",
+ "url": "https://github.com/ipld/go-ipld-prime/pull/472"
+ }
+ ],
+ "credits": [
+ {
+ "name": "@hacdias"
+ }
+ ],
+ "schema_version": "1.3.1"
+}
\ No newline at end of file
diff --git a/data/reports/GO-2023-1269.yaml b/data/reports/GO-2023-1269.yaml
new file mode 100644
index 0000000..4a23430
--- /dev/null
+++ b/data/reports/GO-2023-1269.yaml
@@ -0,0 +1,25 @@
+modules:
+ - module: github.com/ipld/go-ipld-prime
+ versions:
+ - fixed: 0.19.0
+ vulnerable_at: 0.18.0
+ packages:
+ - package: github.com/ipld/go-ipld-prime/codec/dagjson
+ symbols:
+ - Marshal
+ derived_symbols:
+ - Encode
+ - EncodeOptions.Encode
+description: |-
+ Encoding data using the 'json' codec which contains a 'Bytes' type
+ Node will cause the encoder to panic. The decoder is not impacted. If
+ the codec is used to encode user supplied data, this may be used as
+ a vector for a denial of service attack.
+cves:
+ - CVE-2023-22460
+ghsas:
+ - GHSA-c653-6hhg-9x92
+credit: '@hacdias'
+references:
+ - advisory: https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92
+ - fix: https://github.com/ipld/go-ipld-prime/pull/472
