p PatchFirst

CVE-2024-24790

CVE-2024-24790 · Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS 9.8 · Critical · EPSS 2.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • net/netip

    Versions
    • ≥ 0, < 1.21.11: Affected (semver)
    • ≥ 1.22.0-0, < 1.22.4: Affected (semver)

    Update to 1.21.11; Update to 1.22.4

  • golang-1.19 Debian:12

    Versions
    • 1.19.10-1
    • 1.19.10-2
    • 1.19.11-1
    • 1.19.12-1
    • 1.19.12-2
    • 1.19.12-2~bpo11+1
    • 1.19.12-2~bpo12+1
    • 1.19.13-1
    • 1.19.13-1~bpo11+1
    • 1.19.13-1~bpo12+1
    • 1.19.8-2
    • 1.19.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:14.04:LTS

    Versions
    • 1.10.4-2ubuntu1~14.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.18.1-1ubuntu1~16.04.6
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1~16.04.6+esm1

    Update to 1.18.1-1ubuntu1~16.04.6+esm1

  • golang-1.10 Ubuntu:16.04:LTS

    Versions
    • 1.10.4-2ubuntu1~16.04.1
    • 1.10.4-2ubuntu1~16.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.13.8-1ubuntu1~16.04.2
    • 1.13.8-1ubuntu1~16.04.3
    • 1.13.8-1ubuntu1~16.04.3+esm2
    • 1.13.8-1ubuntu1~16.04.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.10 Ubuntu:18.04:LTS

    Versions
    • 1.10~rc1-1
    • 1.10~rc1-1ubuntu1
    • 1.10~rc1-2ubuntu1
    • 1.10~rc2-1ubuntu1
    • 1.10-1ubuntu1
    • 1.10.1-1ubuntu2
    • 1.10.4-2ubuntu1~18.04.1
    • 1.10.4-2ubuntu1~18.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.13 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.13.8-1ubuntu1~18.04.2
    • 1.13.8-1ubuntu1~18.04.3
    • 1.13.8-1ubuntu1~18.04.4
    • 1.13.8-1ubuntu1~18.04.4+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.16.2-0ubuntu1~18.04.2
    • 1.16.2-0ubuntu1~18.04.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.18.1-1ubuntu1~18.04.3
    • 1.18.1-1ubuntu1~18.04.4
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1~18.04.4+esm1

    Update to 1.18.1-1ubuntu1~18.04.4+esm1

  • golang-1.18 Ubuntu:20.04:LTS

    Versions
    • 1.18.1-1ubuntu1~20.04.1
    • 1.18.1-1ubuntu1~20.04.2
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1~20.04.3

    Update to 1.18.1-1ubuntu1~20.04.3

  • golang-1.21 Ubuntu:20.04:LTS

    Versions
    • 1.21.1-1~ubuntu20.04.1
    • 1.21.1-1~ubuntu20.04.2
    Affected ranges
    • ECOSYSTEM: < 1.21.1-1~ubuntu20.04.3

    Update to 1.21.1-1~ubuntu20.04.3

  • golang-1.22 Ubuntu:20.04:LTS

    Affected ranges
    • ECOSYSTEM: < 1.22.2-2~20.04.1

    Update to 1.22.2-2~20.04.1

  • golang-1.13 Ubuntu:20.04:LTS

    Versions
    • 1.13.1-1ubuntu1
    • 1.13.3-1ubuntu1
    • 1.13.4-1ubuntu1
    • 1.13.5-1ubuntu1
    • 1.13.6-1ubuntu1
    • 1.13.6-2ubuntu1
    • 1.13.7-1ubuntu1
    • 1.13.8-1ubuntu1
    • 1.13.8-1ubuntu1.1
    • 1.13.8-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.14 Ubuntu:20.04:LTS

    Versions
    • 1.14~beta1-1
    • 1.14~beta1-2
    • 1.14~rc1-1
    • 1.14-1
    • 1.14.1-1
    • 1.14.2-1
    • 1.14.2-1ubuntu1
    • 1.14.3-2ubuntu2~20.04.1
    • 1.14.3-2ubuntu2~20.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.16 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.16.2-0ubuntu1~20.04
    • 1.16.2-0ubuntu1~20.04.1
    • 1.16.2-0ubuntu1~20.04.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.20 Ubuntu:20.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~20.04
    • 1.20.3-1ubuntu0.1~20.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.17 Ubuntu:22.04:LTS

    Versions
    • 1.17-1ubuntu2
    • 1.17.3-1ubuntu1
    • 1.17.3-1ubuntu2
    • 1.17.13-3ubuntu1
    • 1.17.13-3ubuntu1.2
    • 1.17.13-3ubuntu1.3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.18 Ubuntu:22.04:LTS

    Versions
    • 1.18~beta1-0ubuntu1
    • 1.18~beta2-1ubuntu1
    • 1.18~beta2-1ubuntu2
    • 1.18~rc1-1ubuntu1
    • 1.18-1ubuntu1
    • 1.18.1-1ubuntu1
    • 1.18.1-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.18.1-1ubuntu1.2

    Update to 1.18.1-1ubuntu1.2

  • golang-1.20 Ubuntu:22.04:LTS

    Versions
    • 1.20.3-1ubuntu0.1~22.04
    • 1.20.3-1ubuntu0.1~22.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.21 Ubuntu:22.04:LTS

    Versions
    • 1.21.1-1~ubuntu22.04.1
    • 1.21.1-1~ubuntu22.04.2
    Affected ranges
    • ECOSYSTEM: < 1.21.1-1~ubuntu22.04.3

    Update to 1.21.1-1~ubuntu22.04.3

  • golang-1.22 Ubuntu:22.04:LTS

    Versions
    • 1.22.2-2~22.04
    Affected ranges
    • ECOSYSTEM: < 1.22.2-2~22.04.1

    Update to 1.22.2-2~22.04.1

  • golang-1.13 Ubuntu:Pro:22.04:LTS

    Versions
    • 1.13.8-1ubuntu2
    • 1.13.8-1ubuntu2.22.04.1
    • 1.13.8-1ubuntu2.22.04.1+esm1
    • 1.13.8-1ubuntu2.22.04.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-1.21 Ubuntu:24.04:LTS

    Versions
    • 1.21.1-1
    • 1.21.3-1
    • 1.21.4-1
    • 1.21.5-1
    • 1.21.6-1
    • 1.21.7-1
    • 1.21.7-2
    • 1.21.8-1
    • 1.21.8-1build1
    • 1.21.9-1
    Affected ranges
    • ECOSYSTEM: < 1.21.9-1ubuntu0.1

    Update to 1.21.9-1ubuntu0.1

Original sources

Check your server →