Impact

There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.

They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.

References

• CVE-2024-24790

Patches

• https://github.com/traefik/traefik/releases/tag/v2.11.4
• https://github.com/traefik/traefik/releases/tag/v3.0.2

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

• GHSA-7jmw-8259-q9jx
• https://github.com/traefik/traefik/releases/tag/v2.11.4
• https://github.com/traefik/traefik/releases/tag/v3.0.2
• https://www.cve.org/CVERecord?id=CVE-2024-24790
• https://pkg.go.dev/vuln/GO-2024-2917