CVE-2024-24784 Comments in display names are incorrectly handled in net/mail

2024-03-0522:22:32

github.com

cve-2024-24784

comments

display names

mishandling

address parsers

AI Score

7.1

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:go_standard_library:net\\/mail:*:*:*:*:*:*:*:*"
    ],
    "vendor": "go_standard_library",
    "product": "net\\/mail",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.21.8",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.22.0-0",
        "lessThan": "1.22.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]