Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI0Z3Ytdmo1OS1jY2Nt

Control character injection in console output in github.com/ipfs/go-ipfs

Impact

Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action.

Patches

• Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0

For more information

If you have any questions or comments about this advisory:

• Open an issue in go-ipfs
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-r4gv-vj59-cccm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXI0Z3Ytdmo1OS1jY2Nt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Identifiers: GHSA-r4gv-vj59-cccm, CVE-2020-26283
References:

• https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm
• https://nvd.nist.gov/vuln/detail/CVE-2020-26283
• https://github.com/ipfs/go-ipfs/pull/7831
• https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
• https://github.com/advisories/GHSA-r4gv-vj59-cccm

Repository: https://github.com/ipfs/go-ipfs
Blast Radius: 18.2

Affected Packages