GHSA-6fcr-9h9g-23fq Denial of Service in ipfs-bitswap
An attacker can cause a denial of service by exhausting system resources through unwanted blocks in the IPFS bitswap library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6fcr-9h9g-23fq?
GHSA-6fcr-9h9g-23fq is a denial of service vulnerability in ipfs-bitswap, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of ipfs-bitswap prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions.
Recommendation
Upgrade to version 0.24.1 or later.
Which versions are affected by GHSA-6fcr-9h9g-23fq?
2 open source packages ship an affected version, including ipfs-bitswap.
| Package | Affected | Fixed in |
|---|---|---|
ipfs-bitswap npm | All versions | 0.24.1 |
ipfs-bitswap npm | All versions | 0.24.1 |
How do I fix GHSA-6fcr-9h9g-23fq?
Upgrade ipfs-bitswap to 0.24.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-6fcr-9h9g-23fq being exploited?
There is no known exploitation of GHSA-6fcr-9h9g-23fq in the wild and no public exploit code.