CVE-2020-10937: High severity protocol Ipfs vulnerability
Published Nov 2, 2020
·Updated
An issue was discovered in IPFS (aka go-ipfs) 0.4.23. An attacker can generate ephemeral identities (Sybils) and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later versions, in particular go-ipfs 0.7, mitigate this.
Affected Software
2 affected componentsFixes available
go/github.com/ipfs/go-ipfs<0.7.0
0.7.0
protocol Ipfs=0.4.23
Event History
Nov 2, 2020
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
Description
Apr 24, 2024
Advisory Published
via GitHub·08:01 PM
Frequently Asked Questions
1
What is the severity of CVE-2020-10937?
CVE-2020-10937 is classified as a medium severity vulnerability.
2
How do I fix CVE-2020-10937?
To mitigate CVE-2020-10937, update IPFS to version 0.7.0 or later.
3
What systems are affected by CVE-2020-10937?
CVE-2020-10937 affects IPFS version 0.4.23.
4
What type of attack does CVE-2020-10937 enable?
CVE-2020-10937 allows attackers to perform routing table poisoning and eclipse attacks on IPFS nodes.
5
What is the primary impact of CVE-2020-10937?
The primary impact of CVE-2020-10937 is the disruption of node communication within the IPFS network.