GMS-2022-821: Daemon panics when processing certain blocks
(updated )
go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency. Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks. This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs.
References
Detect and mitigate GMS-2022-821 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →