id: GO-2023-1557
modules:
    - module: github.com/ipfs/go-unixfs
      versions:
        - fixed: 0.4.3
      vulnerable_at: 0.4.2
      packages:
        - package: github.com/ipfs/go-unixfs/hamt
          symbols:
            - makeShard
            - newChilder
          derived_symbols:
            - NewHamtFromDag
            - NewShard
            - NewShardValue
            - Shard.EnumLinks
            - Shard.EnumLinksAsync
            - Shard.Find
            - Shard.ForEachLink
            - Shard.Remove
            - Shard.Set
            - Shard.SetLink
            - Shard.Swap
            - Shard.Take
summary: Denial of service via HAMT decoding panic in github.com/ipfs/go-unixfs
description: |-
    Trying to read malformed HAMT sharded directories can cause panics and virtual
    memory leaks. If you are reading untrusted user input, an attacker can then
    trigger a panic.

    This is caused by bogus "fanout" parameter in the HAMT directory nodes. A
    workaround is to not feed untrusted user data to the decoding functions.
cves:
    - CVE-2023-23625
ghsas:
    - GHSA-q264-w97q-q778
credits:
    - Jorropo
references:
    - advisory: https://github.com/advisories/GHSA-q264-w97q-q778
    - fix: https://github.com/ipfs/go-unixfs/commit/467d139a640ecee4f2e74643dafcc58bb3b54175