| packages: | |
| - module: github.com/ipld/go-codec-dagpb | |
| symbols: | |
| - DecodeBytes | |
| derived_symbols: | |
| - Decode | |
| - Decoder | |
| - Unmarshal | |
| versions: | |
| - fixed: 1.3.1 | |
| vulnerable_at: 1.3.0 | |
| description: The dag-pb codec can panic when decoding invalid blocks. | |
| ghsas: | |
| - GHSA-g3vv-g2j5-45f2 | |
| cve_metadata: | |
| id: CVE-2022-2584 | |
| cwe: "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer" | |
| links: | |
| commit: https://github.com/ipld/go-codec-dagpb/commit/a17ace35cc760a2698645c09868f9050fa219f57 |