CVE-2023-25568

HIGH EPSS 53.8%
Published May 10, 20233y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published May 10, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an attacker is able allocate arbitrary many bytes in the Bitswap server, those allocations are lasting even if the connection is closed. This affects users accepting untrusted connections with the Bitswap server and also affects users using the old API stubs at `github.com/ipfs/go-libipfs/bitswap` because users then transitively import `github.com/ipfs/go-libipfs/bitswap/server`. Boxo versions 0.6.0 and 0.4.1 contain a patch for this issue. As a workaround, those who are using the stub object at `github.com/ipfs/go-libipfs/bitswap` not taking advantage of the features provided by the server can refactor their code to use the new split API that will allow them to run in a client only mode: `github.com/ipfs/go-libipfs/bitswap/client`.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
53.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-400 Uncontrolled Resource Consumption Resource Mgmt
CWE-770

Affected Products 2

VendorProductVersionRange
protocolboxo0.4.0any
protocolboxo0.5.0any

References 4

  • github.com https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916
    Patch
  • github.com https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197
    Patch
  • github.com https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974
    Patch
  • github.com https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5
    MitigationPatchVendor Advisory

Remediation

  • github.com https://github.com/ipfs/boxo/commit/62cbac40b96f49e39cd7fedc77ee6b56adce4916
    Patch
  • github.com https://github.com/ipfs/boxo/commit/9cb5cb54d40b57084d1221ba83b9e6bb3fcc3197
    Patch
  • github.com https://github.com/ipfs/boxo/commit/baa748b682fabb21a4c1f7628a8af348d4645974
    Patch
  • github.com https://github.com/ipfs/go-libipfs/security/advisories/GHSA-m974-xj4j-7qv5
    MitigationPatchVendor Advisory