Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Vendor: ipfs Clear all filters
TI-2023-10871 CVE-2023-25568 · GHSA-m974-xj4j-7qv5

Boxo bitswap/server: DOS unbounded persistent memory leak

Priority MEDIUM 43

Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00856 Published 2023-05-10 Fixed in 0.6.0, 0.4.1 CWE-400
TI-2023-09454 CVE-2023-23625 · GHSA-q264-w97q-q778

Denial of service in HAMT Decoding in go-unixfs

Priority LOW 34

go-unixfs is an implementation of a unix-like filesystem on top of an ipld merkledag.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00675 Published 2023-02-09 Fixed in 0.4.3 CWE-400
TI-2023-09460 CVE-2023-23631 · GHSA-4gj3-6r43-3wfc

HAMT Decoding Panics in github.com/ipfs/go-unixfsnode

Priority LOW 35

github.com/ipfs/go-unixfsnode is an ADL IPLD prime node that wraps go-codec-dagpb's implementation of protobuf to enable pathing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00908 Published 2023-02-09 Fixed in 1.5.2 CWE-400
TI-2020-16104 CVE-2020-26283 · GHSA-r4gv-vj59-cccm

Control character injection in console output

Priority MEDIUM 41

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01501 Published 2021-03-24 Fixed in 0.8.0 CWE-116
TI-2020-16100 CVE-2020-26279 · GHSA-27pv-q55r-222g

Path traversal in ipfs go-ipfs

Priority LOW 39

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01699 Published 2021-03-24 Fixed in 0.8.0-rc1, 0.8.0 CWE-22
TI-2020-08933 CVE-2020-11059 · GHSA-qfcv-5whw-7pcw

Exposure of Sensitive Information to an Unauthorized Actor in AEgir

Priority MEDIUM 43

In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0112 Published 2020-05-27 Fixed in 21.10.1 CWE-200
TI-2016-08604 CVE-2016-10563 · GHSA-g3xp-v2ff-x5c3

Cryptographic flaw in HackerOne go-ipfs-dep node module

Priority LOW 37

During the installation process, the go-ipfs-deps module before 0.4.4 insecurely downloads resources over HTTP.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.00761 Published 2018-05-31 Fixed in 0.4.4 CWE-311