GHSA-6fcr-9h9g-23fq: 
JavaScript vulnerability analysis and mitigation

A Denial of Service (DoS) vulnerability was discovered in ipfs-bitswap, a JavaScript implementation of the Bitswap 'data exchange' protocol used by IPFS. The vulnerability affects versions prior to 0.24.1, where the package would put unwanted blocks in the blockstore. This security issue was initially disclosed on May 29, 2019, and was later published to the GitHub Advisory Database on September 2, 2020. The vulnerability has been assigned a moderate severity rating with a CVSS score of 5.9 (GitHub Advisory).

The vulnerability is tracked as GHSA-6fcr-9h9g-23fq and is classified under CWE-400. The CVSS v3.1 base metrics indicate a network attack vector with high attack complexity, requiring no privileges or user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but high impact on availability. The vulnerability has been assigned the following CVSS string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory, Snyk Report).

The vulnerability could lead to a Denial of Service condition by exhausting system resources. When exploited, the package would store unwanted blocks in the blockstore, potentially causing the service to excessively consume system resources under specific conditions (GitHub Advisory, Snyk Report).

The vulnerability can be exploited remotely, though it requires high attack complexity. No special privileges or user interaction are required to exploit this vulnerability. The attack vector is network-based, making it accessible to remote attackers (GitHub Advisory).

The recommended mitigation is to upgrade ipfs-bitswap to version 0.24.1 or later, which contains the fix for this vulnerability. The fix was implemented to ignore unwanted blocks, preventing them from being stored in the blockstore (GitHub PR, GitHub Advisory).