{"answers":{"affected":"4 open source packages ship an affected version, including github.com/ipld/go-ipfs.","exploited":"There is no known exploitation of GHSA-mcq2-w56r-5w2w in the wild and no public exploit code.","fix":"Upgrade github.com/ipld/go-ipfs to a fixed version for your release line: 0.11.1 or 0.12.2.","what":"GHSA-mcq2-w56r-5w2w is a denial of service vulnerability in github.com/ipld/go-ipfs, published on 8 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-mcq2-w56r-5w2w and fix it if it is affected.\n\nWhat it is: GHSA-mcq2-w56r-5w2w is a denial of service vulnerability in github.com/ipld/go-ipfs, published on 8 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-mcq2-w56r-5w2w in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/ipld/go-ipfs (Go): affected all versions; fixed in 0.11.1\n- github.com/ipld/go-ipfs (Go): affected all versions; fixed in 0.11.1\n- github.com/ipld/go-ipfs (Go): affected from 0.12.0; fixed in 0.12.2\n- github.com/ipld/go-ipfs (Go): affected from 0.12.0; fixed in 0.12.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-mcq2-w56r-5w2w/ (Markdown: https://insights.sbomify.com/GHSA-mcq2-w56r-5w2w/index.md)","id":"GHSA-mcq2-w56r-5w2w","markdown":"https://insights.sbomify.com/GHSA-mcq2-w56r-5w2w/index.md","name":"GHSA-mcq2-w56r-5w2w","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"IPFS node software","requires_auth":"none","summary":"Remote attackers can crash IPFS nodes by sending malformed graph data, causing denial of service for public gateways and pinning services.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\ngo-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency.  Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks.\n\nThis particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs.\n\n### Patches\nVersions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration.\n\nFor those running on forked versions of go-ipfs or who are on v0.10.0 and are having trouble with the v0.11.0 breaking changes, simply updating the version of `go-codec-dagpb` you are using to \u003e=v1.3.2 should resolve the issue.\n\nAny users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-codec-dagpb. You can check if your Go module has a dependency on `go-codec-dagpb` by running a command such as `go mod graph | grep go-codec-dagpb` in your module root.\n\n### Workarounds\nThe best way to workaround this issue is to control exposure to any endpoints that allow for arbitrary IPLD traversals. This primarily includes the HTTP RPC API (https://docs.ipfs.io/reference/http/api ) and the Gateway API.  If you are exposing those APIs, then do so within an environment where only trusted users and applications you control have access to it.  You should be safe as long as your users and applications do not create malformed graphs, which should not happen using standard `go-ipfs` tooling.\n\nIf you previously had a more open access environment, then closing off access will only be sufficient if both of the following are true:\n* The experimental GraphSync feature is disabled (https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#graphsync) \n* The only data being accessed is non-malformed data\n\n### References\nSee also the [go-codec-dagpb security advisory](https://github.com/ipld/go-codec-dagpb/security/advisories/GHSA-g3vv-g2j5-45f2).\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Ask in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)\n* Open an issue in [go-ipfs](https://github.com/ipld/go-ipfs)","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Daemon panics when processing certain blocks","id":"GHSA-mcq2-w56r-5w2w","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":4,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.11.1"],"introduced":["0"],"last_affected":[],"package":"github.com/ipld/go-ipfs","purl":null,"source":"GHSA-mcq2-w56r-5w2w"},{"ecosystem":"Go","fixed":["0.11.1"],"introduced":["0"],"last_affected":[],"package":"github.com/ipld/go-ipfs","purl":"pkg:golang/github.com/ipld/go-ipfs","source":"GHSA-mcq2-w56r-5w2w"},{"ecosystem":"Go","fixed":["0.12.2"],"introduced":["0.12.0"],"last_affected":[],"package":"github.com/ipld/go-ipfs","purl":null,"source":"GHSA-mcq2-w56r-5w2w"},{"ecosystem":"Go","fixed":["0.12.2"],"introduced":["0.12.0"],"last_affected":[],"package":"github.com/ipld/go-ipfs","purl":"pkg:golang/github.com/ipld/go-ipfs","source":"GHSA-mcq2-w56r-5w2w"}],"products":null,"published":"2022-04-08","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Remote attackers can crash IPFS nodes by sending malformed graph data, causing denial of service for public gateways and pinning services.","url":"https://insights.sbomify.com/GHSA-mcq2-w56r-5w2w/"}