CVE-2024-24790
Published: 5 June 2024
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Priority
Status
Package | Release | Status |
---|---|---|
golang-1.10
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Does not exist
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
trusty |
Needs triage
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
|
golang-1.13
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
jammy |
Needs triage
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
|
golang-1.14
Launchpad, Ubuntu, Debian |
focal |
Needs triage
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
golang-1.16
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
jammy |
Does not exist
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
golang-1.17
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Needs triage
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
golang-1.18
Launchpad, Ubuntu, Debian |
bionic |
Needs triage
|
focal |
Needs triage
|
|
jammy |
Needs triage
|
|
mantic |
Does not exist
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
xenial |
Needs triage
|
|
golang-1.20
Launchpad, Ubuntu, Debian |
focal |
Needs triage
|
jammy |
Needs triage
|
|
mantic |
Ignored
(end of life, was needs-triage)
|
|
noble |
Does not exist
|
|
upstream |
Needs triage
|
|
golang-1.21
Launchpad, Ubuntu, Debian |
focal |
Released
(1.21.1-1~ubuntu20.04.3)
|
jammy |
Released
(1.21.1-1~ubuntu22.04.3)
|
|
mantic |
Ignored
(end of life, was needed)
|
|
noble |
Released
(1.21.9-1ubuntu0.1)
|
|
upstream |
Released
(1.21.11-1)
|
|
golang-1.22
Launchpad, Ubuntu, Debian |
focal |
Does not exist
|
jammy |
Released
(1.22.2-2~22.04.1)
|
|
mantic |
Ignored
(end of life, was needed)
|
|
noble |
Released
(1.22.2-2ubuntu0.1)
|
|
upstream |
Released
(1.22.4-1)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 9.8 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
References
- https://www.cve.org/CVERecord?id=CVE-2024-24790
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k
- https://github.com/golang/go/issues/67680
- https://go.dev/cl/590316
- https://go.dev/issue/67680
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://pkg.go.dev/vuln/GO-2024-2887
- https://github.com/golang/go/commit/12d5810cdb1f73cf23d7a86462143e9463317fca (1.22)
- https://github.com/golang/go/commit/051bdf3fd12a40307606ff9381138039c5f452f0 (1.21)
- https://ubuntu.com/security/notices/USN-6886-1
- NVD
- Launchpad
- Debian