Vulnerability · Published Mar 24, 2021 · Assigned by GitHub_M

CVE-2020-26283Control character injection in console output

Medium 6.8

In plain English

A medium-severity security flaw in go-ipfs from ipfs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.5%top 25.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. This is fixed in version 0.8.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	kubo	0.8.0-r0	ALPINE-CVE-2020-26283
Alpine:v3.21	kubo	0.8.0-r0	ALPINE-CVE-2020-26283
Alpine:v3.22	kubo	0.8.0-r0	ALPINE-CVE-2020-26283
Alpine:v3.23	kubo	0.8.0-r0	ALPINE-CVE-2020-26283
Alpine:v3.24	kubo	0.8.0-r0	ALPINE-CVE-2020-26283
Go	github.com/ipfs/go-ipfs	0.8.0	GHSA-r4gv-vj59-cccm
Go	github.com/ipfs/go-ipfs	0.8.0	GO-2022-0873

Affected products (as reported)

Vendor	Product	Versions
ipfs	go-ipfs	< 0.8.0

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

References

https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm x_refsource_CONFIRM
https://github.com/ipfs/go-ipfs/pull/7831 x_refsource_MISC
https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a x_refsource_MISC