Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

严重 9.8CVE-2024-24790 · BIT-golang-2024-24790 · GO-2024-2887 · Published 05/06/2024 · updated 17/06/2026

要点

CVE-2024-24790 是影响 stdlib, go (golang) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.0%，高于 80.2% 的漏洞。
修复：升级到 1.22.4, 1.21.11 或更高版本。

Package	Affected versions	Patched versions
stdlib Go	`≥ 1.22.0-0, < 1.22.4< 1.21.11`	`1.22.41.21.11`
go golang	`≥ 1.22.0, < 1.22.4< 1.21.11`	`1.22.41.21.11`

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

NVD description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

References

go.dev/cl/590316 · FIX
go.dev/issue/67680 · REPORT
groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ · WEB
openwall.com/lists/oss-security/2024/06/04/1 · Mailing List
pkg.go.dev/vuln/GO-2024-2887 · Third Party Advisory
security.netapp.com/advisory/ntap-20240905-0002

stdlib 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

stdlib

≥ 1.22.0-0, < 1.22.4< 1.21.11

1.22.41.21.11

golang

≥ 1.22.0, < 1.22.4< 1.21.11

1.22.41.21.11

Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

NVD description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

stdlib 的其他漏洞

查看全部 →