Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xM2o2LTIyd2YtM2poOc4AAzSh

github.com/ipfs/go-bitswap vulnerable to DOS unbounded persistent memory leak

This package has been moved to github.com/ipfs/boxo/bitswap, this vulnerability is tracked there: https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 (CVE-2023-25568)

Remediation

This is a two step process:

1. Apply one of:
   • (recommended) upgrade from github.com/ipfs/go-bitswap to github.com/ipfs/boxo/bitswap.
   • If you are still using github.com/ipfs/go-bitswap and cannot upgrade to boxo, you can upgrade to github.com/ipfs/[email protected], this will replace the go-bitswap implementation by stubs which points to boxo.
2. Open https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5 and then follow boxo's remediation section.

Vulnerable symbols

• >= v0.9.0; < v0.12.0
  • github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).MessageReceived
  • github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).NotifyNewBlocks
  • github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).findOrCreate
  • github.com/ipfs/go-bitswap/server/internal/decision.(*Engine).PeerConnected
• v0.8.0
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).MessageReceived
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).NotifyNewBlocks
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).findOrCreate
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).PeerConnected
• < v0.8.0
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).MessageReceived
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).receiveBlocksFrom
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).findOrCreate
  • github.com/ipfs/go-bitswap/internal/decision.(*Engine).PeerConnected

Workarounds

If you are using the stubs at github.com/ipfs/go-bitswap and not taking advantage of the features provided by the server, refactoring your code to use the new split API will allows you to run in a client-only mode using: github.com/ipfs/go-bitswap/client.

Permalink: https://github.com/advisories/GHSA-q3j6-22wf-3jh9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xM2o2LTIyd2YtM2poOc4AAzSh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 1 year ago
Updated: over 1 year ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Identifiers: GHSA-q3j6-22wf-3jh9
References:

• https://github.com/ipfs/boxo/security/advisories/GHSA-m974-xj4j-7qv5
• https://github.com/ipfs/go-bitswap/security/advisories/GHSA-q3j6-22wf-3jh9
• https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5
• https://nvd.nist.gov/vuln/detail/CVE-2023-25568
• https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916
• https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197
• https://github.com/advisories/GHSA-q3j6-22wf-3jh9

Repository: https://github.com/ipfs/boxo
Blast Radius: 22.9

Affected Packages