Vulnerability Report: GO-2024-2887
standard library- CVE-2024-24790
- Affects: net/netip
- Published: Jun 04, 2024
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected Packages
-
PathGo VersionsSymbols
-
before go1.21.11, from go1.22.0-0 before go1.22.4
Aliases
References
- https://go.dev/cl/590316
- https://go.dev/issue/67680
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://vuln.go.dev/ID/GO-2024-2887.json
Credits
- Enze Wang of Alioth (@zer0yu), Jianjun Chen of Zhongguancun Lab (@chenjj)
Feedback
See anything missing or incorrect?
Suggest an edit to this report.