modules:
  - module: github.com/ipld/go-ipld-prime
    versions:
      - fixed: 0.19.0
    vulnerable_at: 0.18.0
    packages:
      - package: github.com/ipld/go-ipld-prime/codec/dagjson
        symbols:
          - Marshal
        derived_symbols:
          - Encode
          - EncodeOptions.Encode
description: |-
    Encoding data using the 'json' codec which contains a 'Bytes' type
    Node will cause the encoder to panic. The decoder is not impacted. If
    the codec is used to encode user supplied data, this may be used as
    a vector for a denial of service attack.
cves:
  - CVE-2023-22460
ghsas:
  - GHSA-c653-6hhg-9x92
credit: '@hacdias'
references:
  - advisory: https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92
  - fix: https://github.com/ipld/go-ipld-prime/pull/472