data/reports/GO-2023-1269.yaml

id: GO-2023-1269
modules:
    - module: github.com/ipld/go-ipld-prime
      versions:
        - fixed: 0.19.0
      vulnerable_at: 0.18.0
      packages:
        - package: github.com/ipld/go-ipld-prime/codec/dagjson
          symbols:
            - Marshal
          derived_symbols:
            - Encode
            - EncodeOptions.Encode
summary: Panic in encoding in github.com/ipld/go-ipld-prime
description: |-
    Encoding data using the 'json' codec which contains a 'Bytes' type Node will
    cause the encoder to panic. The decoder is not impacted. If the codec is used to
    encode user supplied data, this may be used as a vector for a denial of service
    attack.
cves:
    - CVE-2023-22460
ghsas:
    - GHSA-c653-6hhg-9x92
credits:
    - '@hacdias'
references:
    - advisory: https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92
    - fix: https://github.com/ipld/go-ipld-prime/pull/472
review_status: REVIEWED