medium6.8
CVE-2020-26283
Control character injection in console output in github.com/ipfs/go-ipfs
Impact
### Impact Control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown, malicious action. ### Patches <!-- _Has the problem been patched? What versions should users upgrade to?_ --> - Patched via https://github.com/ipfs/go-ipfs/pull/7831 in v0.8.0 ### For more information If you have any questions or comments about this advisory: * Open an issue in [go-ipfs](http://github.com/ipfs/go-ipfs) * Email us at [security@ipfs.io](mailto:security@ipfs.io)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ipfs/go-ipfs | < 0.8.0 | 0.8.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Protocol | Go-Ipfs | before 0.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/ipfs/go-ipfs/commit/fb0a9acd2d8288bd1028c3219a420de62a09683a
- https://github.com/ipfs/go-ipfs/pull/7831
- https://github.com/ipfs/go-ipfs/security/advisories/GHSA-r4gv-vj59-cccm
- https://github.com/advisories/GHSA-r4gv-vj59-cccm
- https://nvd.nist.gov/vuln/detail/CVE-2020-26283