We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-24790

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip



Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Reserved 2024-01-30 | Published 2024-06-05 | Updated 2024-09-05 | Assigner Go

Problem types

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize

Product status

Default status
unaffected

Any version before 1.21.11
affected

1.22.0-0 before 1.22.4
affected

Credits

Enze Wang of Alioth (@zer0yu)

Jianjun Chen of Zhongguancun Lab (@chenjj)

References

go.dev/cl/590316

go.dev/issue/67680

groups.google.com/...g-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ

pkg.go.dev/vuln/GO-2024-2887

www.openwall.com/lists/oss-security/2024/06/04/1

cve.org (CVE-2024-24790)

nvd.nist.gov (CVE-2024-24790)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-24790

Support options

Helpdesk Chat, Email, Knowledgebase
Subscribe to our newsletter to learn more about our work.