CVE-2024-24784 Comments in display names are incorrectly handled in net/mail
The Go net/mail library mishandles comments in display names, potentially causing inconsistent trust decisions across different parsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-24784?
CVE-2024-24784 is a high-severity vulnerability in Go standard library net/mail, published on 5 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
Which versions are affected by CVE-2024-24784?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.21.8, 1.22.1 |
stdlib Go | All versions | 1.21.8, 1.22.1 |
How do I fix CVE-2024-24784?
Upgrade golang to a fixed version for your release line: 1.21.8 or 1.22.1.
Is CVE-2024-24784 being exploited?
There is no known exploitation of CVE-2024-24784 in the wild and no public exploit code.
Sources
Also known as AZL-37466, AZL-37519, AZL-79048, AZL-98655, BELL-CVE-2024-24784, BIT-golang-2024-24784 and 8 more.