FreeBSD : traefik -- Unexpected behavior with IPv4-mapped IPv6 addresses (219aaa1e-2aff-11ef-ab37-5404a68ad561)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 219aaa1e-2aff-11ef-ab37-5404a68ad561 advisory. The traefik authors report: There is a vulnerability in Go managing various Is methods IsPrivate,...

FreeBSD : go -- multiple vulnerabilities (a5c64f6f-2af3-11ef-a77e-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a5c64f6f-2af3-11ef-a77e-901b0e9408dc advisory. The Go project reports: archive/zip: mishandling of corrupt central directory record The...

GO-2024-2917 Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses in github.com/traefik/traefik...

Updated golang packages fix security vulnerabilities

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

GHSA-7JMW-8259-Q9JX Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

Impact There is a vulnerability in Go managing various Is methods IsPrivate, IsLoopback, etc for IPv4-mapped IPv6 addresses. They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms. References - CVE-2024-24790 Patches -...

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

Impact There is a vulnerability in Go managing various Is methods IsPrivate, IsLoopback, etc for IPv4-mapped IPv6 addresses. They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms. References - CVE-2024-24790 Patches -...

SUSE-SU-2024:1970-1 Security update for go1.22

This update for go1.22 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

SUSE-SU-2024:1969-1 Security update for go1.21

This update for go1.21 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

Improper Input Validation

github.com/golang/go/ is vulnerable to Improper Input Validation. The vulnerability is due to various methods IsPrivate, IsLoopback, etc. which do not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:1936-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1936-1 advisory. go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. -...

SUSE-SU-2024:1935-1 Security update for go1.22

This update for go1.22 fixes the following issues: go1.21.11 release bsc1212475. - CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973. - CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses bsc1225974...

BIT-GOLANG-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

Golang < 1.21.11, 1.22.x < 1.22.4 Multiple Vulnerabilities

The version of Golang running on the remote host is prior to 1.21.11 or 1.22.x prior to 1.22.4. It is, therefore, is affected by multiple vulnerabilities: - archive/zip: mishandling of corrupt central directory record allows for the insertion of code and contents depending on the implementation...

CVE-2024-24790

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42395 CVE-2024-24790 affecting package golang for versions less than 1.22.3-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-98679 CVE-2024-24790 affecting package golang 1.27.1-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-79050 CVE-2024-24790 affecting package golang 1.25.7-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42409 CVE-2024-24790 affecting package golang for versions less than 1.18.8-4

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42403 CVE-2024-24790 affecting package golang for versions less than 1.21.11-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...

AZL-42386 CVE-2024-24790 affecting package msft-golang for versions less than 1.21.6-1

The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms...