Vulnerability in golang package: ParseAddressList Function Misalignment
Summary
CVE-2024-24784: Comments in display names are incorrectly handled in net/mail. Affects golang across 2 version ranges.
< 1.21.8
>= 1.22.0-0, < 1.22.1
Fixed in 1.21.8 or 1.22.1, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-24784 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package, developed by Bitnami, is a popular open-source programming language widely used for building efficient and reliable software applications. It provides a robust set of tools and libraries for various purposes. However, a vulnerability has been identified in the package's ParseAddressList function, which incorrectly handles comments within display names. This misalignment with conforming address parsers can lead to different trust decisions being made by programs using different parsers.
Vulnerability Detail
The ParseAddressList function in the golang package has a flaw that affects the handling of comments within display names. This means that if a display name contains comments (text within parentheses), it may not be parsed correctly by the function. As a result, different parsers may interpret the address list differently, leading to potential trust issues. This vulnerability can be exploited by an attacker to manipulate email addresses and potentially deceive or bypass security measures in programs that rely on accurate address parsing.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.21.81.21.8 -
>= 1.22.0-0, < 1.22.11.22.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to update the golang package to the latest version as mentioned in the 'how_to_fix' section.
Conclusion
The golang package is vulnerable to a flaw in the ParseAddressList function, which incorrectly handles comments within display names. This can lead to different trust decisions being made by programs using different parsers, potentially allowing attackers to manipulate email addresses and deceive or bypass security measures. To mitigate this vulnerability, it is crucial to update the golang package to version 1.21.8 or later. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for golang →
FAQ
This vulnerability can lead to different trust decisions being made by programs using different parsers. It may allow an attacker to manipulate email addresses and potentially deceive or bypass security measures.
The vulnerability affects versions 0.0.0, 1.22.0-0, and earlier. It has been fixed in version 1.21.8 and later.
There are no known exploits for this vulnerability at the moment. However, it is important to update the golang package to the latest version to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely if an attacker can manipulate the email addresses being parsed by programs using the golang package.
For more information about this vulnerability, you can refer to the vulnerability details provided by Bitnami in their vulnerability database.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
