CVE-2020-26283: Control character injection in console output
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26283?
CVE-2020-26283 has a severity rating that can vary but is considered to be moderate due to its potential impact on user input visibility.
How do I fix CVE-2020-26283?
To fix CVE-2020-26283, upgrade to go-ipfs version 0.8.0 or later, where the issue has been addressed.
What are the consequences of CVE-2020-26283?
The consequences of CVE-2020-26283 include the risk of user input being obscured due to unescaped control characters in console output.
Which versions of go-ipfs are affected by CVE-2020-26283?
CVE-2020-26283 affects all versions of go-ipfs prior to version 0.8.0.
Is CVE-2020-26283 a remote code execution vulnerability?
CVE-2020-26283 is not a remote code execution vulnerability but rather a local issue affecting console output visibility.