Lucene search

K
freebsdFreeBSD219AAA1E-2AFF-11EF-AB37-5404A68AD561
HistoryJun 05, 2024 - 12:00 a.m.

traefik -- Unexpected behavior with IPv4-mapped IPv6 addresses

2024-06-0500:00:00
vuxml.freebsd.org
traefik
vulnerability
go
ipv4-mapped ipv6 addresses
is methods

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.0%

The traefik authors report:

There is a vulnerability in Go managing various Is methods
(IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn’t work as expected returning false for addresses
which would return true in their traditional IPv4 forms.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchtraefik< 2.11.4UNKNOWN

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.0%