modules:
  - module: github.com/ipfs/go-merkledag
    versions:
      - introduced: 0.4.0
        fixed: 0.8.1
    vulnerable_at: 0.7.0
    packages:
      - package: github.com/ipfs/go-merkledag
        symbols:
          - ProtoNode.SetCidBuilder
          - ProtoNode.marshalImmutable
          - ProtoNode.AddRawLink
          - ProtoNode.UnmarshalJSON
          - ProtoNode.Cid
          - ProtoNode.RawData
          - ProtoNode.Multihash
          - ProtoNode.SetLinks
        derived_symbols:
          - ProtoNode.AddNodeLink
          - ProtoNode.AsBool
          - ProtoNode.AsBytes
          - ProtoNode.AsFloat
          - ProtoNode.AsInt
          - ProtoNode.AsLink
          - ProtoNode.AsString
          - ProtoNode.EncodeProtobuf
          - ProtoNode.IsAbsent
          - ProtoNode.IsNull
          - ProtoNode.Kind
          - ProtoNode.Length
          - ProtoNode.ListIterator
          - ProtoNode.Loggable
          - ProtoNode.LookupByIndex
          - ProtoNode.LookupByNode
          - ProtoNode.LookupBySegment
          - ProtoNode.LookupByString
          - ProtoNode.MapIterator
          - ProtoNode.Marshal
          - ProtoNode.Size
          - ProtoNode.Stat
          - ProtoNode.String
          - ProtoNode.UpdateNodeLink
description: |-
    A ProtoNode may be modified in such a way as to cause various encode
    errors which will trigger a panic on common method calls that don't
    allow for error returns.

    Additionally, use of the ProtoNode.SetCidBuilder() method to set
    non-functioning CidBuilder (such as one that refers to a multihash
    where an implementation of that hash function is not available) may
    cause the same methods to panic as a new CID is required but cannot
    be created.
cves:
  - CVE-2022-23495
ghsas:
  - GHSA-x39j-h85h-3f46
credit: '@mrd0ll4r (https://github.com/mrd0ll4r)'
references:
  - advisory: https://github.com/ipfs/go-merkledag/security/advisories/GHSA-x39j-h85h-3f46
  - report: https://github.com/ipfs/kubo/issues/9297
  - report: https://github.com/ipfs/go-merkledag/issues/90
  - fix: https://github.com/ipfs/go-merkledag/pull/91
  - fix: https://github.com/ipfs/go-merkledag/pull/92
  - fix: https://github.com/ipfs/go-merkledag/pull/93