{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ipfs/go-ipfs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.0"
            },
            {
              "fixed": "0.13.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T20:06:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\ngo-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running `ipfs dag import` on untrusted user inputs, for example, pinning services with a car ingest endpoint.\nThis include the corresponding [HTTP RPC API `v0/dag/import`](https://docs.ipfs.io/reference/http/api/#api-v0-dag-import) endpoint.\n\nAn attacker controlling the car file passed in can also make the node allocate arbitrary sized buffers creating memory exhaustion attacks.\n\n### Patches\n0.13.1, 0.14 and later.\n\n#### Forks\nFor those running on forked versions of go-ipfs, simply updating the version of `github.com/ipld/go-car/v2` you are using to \u003e= v2.4.0 should resolve the issue.\n\n#### Libraries consumers\nAny users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-car.\n\nYou can check if your Go module has a dependency on go-car by running a command such as `go mod graph | grep go-car`  in your module root.\n\nNote: if you are using other libraries, some parts of go-car (`github.com/ipld/go-car/v2/index/...`) have not fully been fixed yet.  Please see [go-car\u0027s security advisory](https://github.com/ipld/go-car/security/advisories/GHSA-9x4h-8wgm-8xfg) for more information.  go-ipfs do not make use of this code.\n\n### Workarounds\nThe best way to work around this is to control exposure to the [HTTP RPC API endpoint for CAR imports](https://docs.ipfs.io/reference/http/api/#api-v0-dag-import) to only work with trusted data.\n\nYou can also validate that the car will not crash go-ipfs by running `car verify` on it first (`go install github.com/ipld/go-car/cmd/car@latest`).\n\n### References\nSee also the [go-car security advisory](https://github.com/ipld/go-car/security/advisories/GHSA-9x4h-8wgm-8xfg).\n\n### For more information\nIf you have any questions or comments about this advisory:\n1. Ask in the [IPFS Discourse](discuss.ipfs.io/)\n1. Ask in the [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)\n1. Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)",
  "id": "GHSA-f2gr-7299-487h",
  "modified": "2022-07-06T20:06:56Z",
  "published": "2022-07-06T20:06:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ipfs/go-ipfs/security/advisories/GHSA-f2gr-7299-487h"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ipfs/go-ipfs"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "DOS and excessive memory usage when passing untrusted user input to to dag import"
}