CVE-2020-10937 Access Restriction Bypass in go-ipfs
Attackers can eclipse target nodes by poisoning routing tables via Sybil attacks, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10937?
CVE-2020-10937 is a high-severity vulnerability in n/a, published on 2 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.
Which versions are affected by CVE-2020-10937?
3 open source packages ship an affected version, including github.com/ipfs/go-ipfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ipfs/go-ipfs Go | All versions | 0.7.0 |
github.com/ipfs/go-ipfs Go | All versions | 0.7.0 |
github.com/ipfs/go-ipfs Go | All versions | 0.7.0 |
Products include Protocol Ipfs.
How do I fix CVE-2020-10937?
Upgrade github.com/ipfs/go-ipfs to 0.7.0 or later.
Is CVE-2020-10937 being exploited?
There is no known exploitation of CVE-2020-10937 in the wild and no public exploit code.
Sources
Also known as GHSA-r23h-3jmw-q7hr, GO-2024-2779.