Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

ipns versions 0.1.1 and 0.1.2 allow any key to be used

published 7 years ago
Summary

Old versions of ipns don't properly check keys, which means someone could use an unauthorized key to access your data. Update to ipns version 0.1.3 or later to fix this and keep your data secure.

What to do
  • Update npm-service-account-ipfs ipns to version 0.1.3.
Affected software
Ecosystem VendorProductAffected versions
npm npm-service-account-ipfs ipns < 0.1.3
Fix: upgrade to 0.1.3
Original advisory text
Improper Key Verification in ipns
Versions 0.1.1 or 0.1.2 of `ipns` are vulnerable to improper key validation. This is due to the public key verification was not being performed properly, resulting in any key being valid.


## Recommendation

Update to version 0.1.3 or later.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Type
CWE-287Improper Authentication
Timeline
Published30 May 2019
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-j59f-6m4q-62h6 · GHSA
Track software like this
Free during beta