Vulnerability · Published Oct 25, 2024 · Assigned by mitre
CVE-2023-26248
Medium 5.3
In plain English
A medium-severity cross-site request forgery in the github.com/libp2p/go-libp2p-kad-dht package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., information about who holds the content) to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content by generating many Sybil peers whose peer IDs have a small distance from the content ID, thus hijacking the content resolution process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/libp2p/go-libp2p-kad-dht | no fix listed | GHSA-mqr9-hjr8-2m9w |
| Go | github.com/libp2p/go-libp2p-kad-dht | no fix listed | GO-2024-3218 |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N