Skip to content

Unexpected behavior with IPv4-mapped IPv6 addresses

Moderate
nmengin published GHSA-7jmw-8259-q9jx Jun 11, 2024

Package

gomod Traefik (Go)

Affected versions

<= v2.11.3, <= v3.0.1

Patched versions

v2.11.4, v3.0.2

Description

Impact

There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.

They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.

References

Patches

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

Severity

Moderate

CVE ID

CVE-2024-24790

Weaknesses

No CWEs