Skip to content

"json" codec may panic if asked to encode bytes

Moderate
rvagg published GHSA-c653-6hhg-9x92 Jan 3, 2023

Package

gomod github.com/ipld/go-ipld-prime/codec/json (Go)

Affected versions

<0.19.0

Patched versions

0.19.0

Description

Impact

Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encode should be treated as an error, as plain JSON should not be able to encode Bytes.

This only impacts uses of the "json" codec, "dag-json" is not impacted. Use of "json" as a decoder is not impacted.

Patches

Fixed in v0.19.0.

Workarounds

Prefer the "dag-json" codec which has the ability to encode bytes.

References

See fix in #472

Credit

Thanks to @hacdias for discovering this error!

Severity

Moderate

CVE ID

CVE-2023-22460

Weaknesses

No CWEs

Credits