Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2024-24790
PUBLISHED
More InfoOfficial Page
Assigner-Go
Assigner Org ID-1bb62c36-49e3-4200-9d77-64a1400537cc
View Known Exploited Vulnerability (KEV) details
Published At-05 Jun, 2024 | 15:13
Updated At-13 Feb, 2025 | 17:40
Rejected At-
▼CVE Numbering Authority (CNA)
Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Affected Products
Vendor
Go standard library
Product
net/netip
Collection URL
https://pkg.go.dev
Package Name
net/netip
Program Routines
  • Addr.IsLoopback
  • Addr.IsMulticast
  • Addr.IsInterfaceLocalMulticast
  • Addr.IsLinkLocalMulticast
  • Addr.IsGlobalUnicast
  • Addr.IsPrivate
Default Status
unaffected
Versions
Affected
  • From 0 before 1.21.11 (semver)
  • From 1.22.0-0 before 1.22.4 (semver)
Problem Types
TypeCWE IDDescription
N/AN/ACWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Type: N/A
CWE ID: N/A
Description: CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Enze Wang of Alioth (@zer0yu)
Jianjun Chen of Zhongguancun Lab (@chenjj)
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://go.dev/cl/590316
N/A
https://go.dev/issue/67680
N/A
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
N/A
https://pkg.go.dev/vuln/GO-2024-2887
N/A
http://www.openwall.com/lists/oss-security/2024/06/04/1
N/A
Hyperlink: https://go.dev/cl/590316
Resource: N/A
Hyperlink: https://go.dev/issue/67680
Resource: N/A
Hyperlink: https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
Resource: N/A
Hyperlink: https://pkg.go.dev/vuln/GO-2024-2887
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/06/04/1
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://go.dev/cl/590316
x_transferred
https://go.dev/issue/67680
x_transferred
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
x_transferred
https://pkg.go.dev/vuln/GO-2024-2887
x_transferred
http://www.openwall.com/lists/oss-security/2024/06/04/1
x_transferred
https://security.netapp.com/advisory/ntap-20240905-0002/
N/A
Hyperlink: https://go.dev/cl/590316
Resource:
x_transferred
Hyperlink: https://go.dev/issue/67680
Resource:
x_transferred
Hyperlink: https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
Resource:
x_transferred
Hyperlink: https://pkg.go.dev/vuln/GO-2024-2887
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/06/04/1
Resource:
x_transferred
Hyperlink: https://security.netapp.com/advisory/ntap-20240905-0002/
Resource: N/A
2. CISA ADP Vulnrichment
Affected Products
Vendor
Gogolang
Product
go
CPEs
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From 0 before 1.21.11 (semver)
  • From 1.22.0-0 before 1.22.4 (semver)
Metrics
VersionBase scoreBase severityVector
3.19.8CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 9.8
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found