CVE-2023-22460

HIGH
Published Jan 4, 20233y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jan 4, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

go-ipld-prime is an implementation of the InterPlanetary Linked Data (IPLD) spec interfaces, a batteries-included codec implementations of IPLD for CBOR and JSON, and tooling for basic operations on IPLD objects. Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes. This only impacts uses of the `json` codec. `dag-json` is not impacted. Use of `json` as a decoder is not impacted. This issue is fixed in v0.19.0. As a workaround, one may prefer the `dag-json` codec, which has the ability to encode bytes.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-20 Improper Input Validation Validation

Affected Products 1

VendorProductVersionRange
protocolgo-ipld-prime* <0.19.0

References 3

  • github.com https://github.com/ipld/go-ipld-prime/pull/472
    PatchThird Party Advisory
  • github.com https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0
    Release NotesThird Party Advisory
  • github.com https://github.com/ipld/go-ipld-prime/security/advisories/GHSA-c653-6hhg-9x92
    Third Party Advisory

Remediation

  • github.com https://github.com/ipld/go-ipld-prime/pull/472
    PatchThird Party Advisory