CVE-2022-2584: Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb
Published Dec 27, 2022
·Updated
The dag-pb codec can panic when decoding invalid blocks.
Affected Software
1 affected component
protocol Go-codec-dagpb Go<1.3.1
Remediation
Patch Available
Event History
Dec 27, 2022
CVE Published
via MITRE·09:13 PM
Data Sourced
via MITRE·09:13 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2022-2584?
CVE-2022-2584 has a medium severity level due to its potential to cause application panics.
2
How do I fix CVE-2022-2584?
To fix CVE-2022-2584, upgrade the go-codec-dagpb package to version 1.3.1 or later.
3
What type of vulnerability is CVE-2022-2584?
CVE-2022-2584 is an issue related to the decoding of invalid blocks in the dag-pb codec.
4
Which software is affected by CVE-2022-2584?
CVE-2022-2584 affects versions of the go-codec-dagpb package prior to 1.3.1.
5
Can CVE-2022-2584 lead to application crashes?
Yes, CVE-2022-2584 can cause application panics if unhandled invalid blocks are decoded.