GHSA-7JMW-8259-Q9JX Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

Impact There is a vulnerability in Go managing various Is methods IsPrivate, IsLoopback, etc for IPv4-mapped IPv6 addresses. They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms. References - CVE-2024-24790 Patches -...

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

Impact There is a vulnerability in Go managing various Is methods IsPrivate, IsLoopback, etc for IPv4-mapped IPv6 addresses. They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms. References - CVE-2024-24790 Patches -...

SUSE-SU-2024:1970-1 Security update for go1.22

This update for go1.22 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

SUSE-SU-2024:1969-1 Security update for go1.21

This update for go1.21 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

Improper Input Validation

github.com/golang/go/ is vulnerable to Improper Input Validation. The vulnerability is due to various methods IsPrivate, IsLoopback, etc. which do not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:1936-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1936-1 advisory. go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. -...

SUSE-SU-2024:1935-1 Security update for go1.22

This update for go1.22 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

BIT-GOLANG-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Golang < 1.21.11, 1.22.x < 1.22.4 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.21.11 or 1.22.x prior to 1.22.4. It is, therefore, is affected by multiple vulnerabilities: - archive/zip: mishandling of corrupt central directory record allows for the insertion of code and contents depending on the implementation...

CVE-2024-24790

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-79050 CVE-2024-24790 affecting package golang 1.25.7-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42409 CVE-2024-24790 affecting package golang for versions less than 1.18.8-4

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42395 CVE-2024-24790 affecting package golang for versions less than 1.22.3-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-98679 CVE-2024-24790 affecting package golang 1.27.1-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42403 CVE-2024-24790 affecting package golang for versions less than 1.21.11-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42386 CVE-2024-24790 affecting package msft-golang for versions less than 1.21.6-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-24790

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

CVE-2024-24790

Summary: CVE-2024-24790 concerns the behavior of the Go networking IsPrivate/IsLoopback (and related) methods when given IPv4-mapped IPv6 addresses. The connected advisories/entries confirm a mismatch where these addresses could be treated as non-private, non-loopback in Go’s net/ip logic, potent...