CVE-2024-24790 — Misinterpretation of Input in Standard Library NET Netip

CWE-115 — Misinterpretation of InputCWE-180 — Incorrect Behavior Order: Validate Before Canonicalize13 documents9 sources
Severity
9.8CRITICALNVD
EPSS
0.2%
top 61.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
GO Standard Library NET NetipGithub.com Traefik TraefikGithub.com Traefik Traefik V2+2 more
Timeline
PublishedJun 5
Latest updateNov 14

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶NVDgolang/go1.22.0 — 1.22.4+1
▶CVEListV5go_standard_library/net_netip1.22.0-0 — 1.22.4+1
▶Gogithub.com/traefik_traefik_v33.0.0-beta3 — 3.0.2

Patches

Patch: go.dev ↗Patch: go.dev ↗

🔴Vulnerability Details

7
GHSA
github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses↗2024-10-25
▶
GHSA
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses↗2024-06-11
▶
OSV
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses↗2024-06-11
▶
GHSA
GHSA-49gw-vxvf-fc2g: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would↗2024-06-05
▶
OSV
CVE-2024-24790: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would↗2024-06-05
▶

📋Vendor Advisories

5
Ubuntu
Go vulnerabilities↗2024-11-14
▶
Ubuntu
Go vulnerabilities↗2024-07-09
▶
Microsoft
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip↗2024-06-11
▶
Red Hat
golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses↗2024-06-04
▶
Debian
CVE-2024-24790: golang-1.15 - The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for...↗2024
▶
CVE-2024-24790 — Misinterpretation of Input | cvebase