IPv6 Zone ID Certificate URI Vulnerability in Golang Package
Summary
CVE-2024-45341: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509. Affects golang across 3 version ranges.
< 1.22.11
>= 1.23.0-0, < 1.23.5
>= 1.24.0-0, < 1.24.0
Fixed in 1.22.11, 1.23.5 or 1.24.0, depending on the release line you run. How to fix ↓
Also tracked for
- golang-1.15 · Debian:11
- stdlib · Go
The same CVE-2024-45341 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Golang, developed by Google, is an open-source programming language designed for simplicity and efficiency. It is widely used for building web servers, data pipelines, and other software applications. The language's robust standard library and concurrency support make it a popular choice among developers. However, a recent vulnerability has been identified that affects private PKIs utilizing URIs with IPv6 addresses containing zone IDs.
Vulnerability Detail
The vulnerability arises from a flaw in the handling of certificates containing URIs with IPv6 addresses that include zone IDs. This issue may lead to incorrect satisfaction of URI name constraints applied to the certificate chain. While certificates with URIs are not permitted in the web PKI, this vulnerability poses a risk to users of private PKIs that do utilize such certificates. If exploited, it could allow unauthorized access or validation of certificates that should otherwise be restricted.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.22.111.22.11 -
>= 1.23.0-0, < 1.23.51.23.5 -
>= 1.24.0-0, < 1.24.01.24.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using certificates with URIs that contain IPv6 addresses with zone IDs in their private PKIs until the package is updated. This may involve reconfiguring the PKI setup to eliminate such certificates.
Conclusion
The identified vulnerability in the Golang package regarding IPv6 zone ID certificate URIs poses a significant risk to users of private PKIs. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, users should consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows for incorrect validation of URI name constraints in certificates, specifically those with IPv6 addresses containing zone IDs.
Users of private PKIs that utilize certificates with URIs containing IPv6 addresses with zone IDs are at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider reconfiguring your PKI to avoid using the vulnerable certificate types as a temporary measure.
No, this vulnerability specifically affects private PKIs as certificates with URIs are not permitted in the web PKI.
References
Related vulnerabilities
Recent vulnerabilities recorded for golang.
