CVE-2024-6284 Improper IPv4 and IPv6 byte order storage in github.com/google/nftables

2024-07-0322:58:17

CWE-20

Google

www.cve.org

cve-2024-6284

ip addresses

byte order

nftables configuration

bug fix

CVSS4

6.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/SC:L/VI:L/SI:L/VA:L/SA:L

EPSS

Percentile

15.8%

JSON

In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses).

This issue affects: https://pkg.go.dev/github.com/google/[email protected]

The bug was fixed in the next released version: https://pkg.go.dev/github.com/google/[email protected]

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "https://github.com/google/nftables",
    "repo": "https://github.com/google/nftables",
    "vendor": "Google",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.0"
      },
      {
        "status": "unaffected",
        "version": "0.2.0"
      }
    ]
  }
]