CVE-2023-22460

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Improper Input Validation pada protocol go-ipld-prime. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes.

Rincian

Terbit di NVD

4 Januari 2023

Terakhir diubah

27 Agustus 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ipld/go-ipld-prime/pull/472 patch · advisory pihak ketiga
• https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0 release notes · advisory pihak ketiga
• https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/08/27/1