go-ipld-prime is a series of Go interfaces for manipulating IPLD data and a Go module that contains the go-ipld-prime/codec/json codec.

Impact

Encoding data which contains a Bytes kind Node will pass a Bytes token to the JSON encoder which will panic as it doesn't expect to receive Bytes tokens. Such an encoding should be treated as an error, as plain JSON should not be able to encode Bytes.

This only impacts uses of the "json" codec, "dag-json" is not impacted. Use of "json" as a decoder is not impacted.

Patches

Fixed in v0.19.0.

Workarounds

Prefer the "dag-json" codec which has the ability to encode bytes.

References

See fix in #472

References

• GHSA-c653-6hhg-9x92
• https://nvd.nist.gov/vuln/detail/CVE-2023-22460
• ipld/go-ipld-prime#472
• https://github.com/ipld/go-ipld-prime/releases/tag/v0.19.0
• https://pkg.go.dev/vuln/GO-2023-1269
• ipld/go-ipld-prime@146d1c8