We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-24790

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip



AssignerGo
Reserved2024-01-30
Published2024-06-05
Updated2024-09-05

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Problem types

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize

Product status

Default status
0x40036ba560

Any version before 1.21.11
affected

1.22.0-0 before 1.22.4
affected

Credits

Enze Wang of Alioth (@zer0yu)

Jianjun Chen of Zhongguancun Lab (@chenjj)

References

https://go.dev/cl/590316

https://go.dev/issue/67680

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ

https://pkg.go.dev/vuln/GO-2024-2887

http://www.openwall.com/lists/oss-security/2024/06/04/1

cve.org CVE-2024-24790

nvd.nist.gov CVE-2024-24790

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-24790
Subscribe to our newsletter to learn more about our work.