High severity · published Mar 24, 2021
CVE-2020-26279
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem
8.1
CVSS
1.7%
EPSS
No
On KEV
Description
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Go-ipfs · Protocol
through 0.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26279
Patch
https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2
Third Party Advisory
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222g
Patch
https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
More from Go-ipfs
8.8
CVE-2020-26283
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem