Interpretation Differences

2024-03-1717:30:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

interpretation differences

parsing

address parsers

trust decisions

vulnerability

software

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

net/mail in GO is vulnerable to Interpretation Differences. The vulnerability is due to the ParseAddressList function incorrectly handling comments (text within parentheses) inside display names. The parser handles the display names different then conforming address parsers, which could result in different trust decisions if an application uses multiple parsers.

CPENameOperatorVersion
go:3.19eq1.21.3-r1
go:3.19eq1.21.4-r0
go:3.19eq1.21.7-r0
go:3.19eq1.21.5-r0
go:edgeeq1.17.6-r0
go:edgeeq1.21.2-r0
go:edgeeq1.21.5-r0
go:edgeeq1.22.0-r0
go:edgeeq1.16.2-r0
go:edgeeq1.16.3-r0

Name	Operator	Version
go:3.19	eq	1.21.3-r1
go:3.19	eq	1.21.4-r0
go:3.19	eq	1.21.7-r0
go:3.19	eq	1.21.5-r0
go:edge	eq	1.17.6-r0
go:edge	eq	1.21.2-r0
go:edge	eq	1.21.5-r0
go:edge	eq	1.22.0-r0
go:edge	eq	1.16.2-r0
go:edge	eq	1.16.3-r0