GHSA-7h65-4p22-39j6 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Incorrect handling of IPv4-mapped IPv6 addresses in Go's net/netip package allows bypassing IP-based security checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7h65-4p22-39j6?
GHSA-7h65-4p22-39j6 is a vulnerability in github.com/crossplane/crossplane, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless.
Critical Vulnerabilities
Vulnerability: CVE-2024-24790, golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Affected versions: 1.17.1,1.16.2,1.15.5
See screenshot for more details
Fixed versions: 1.17.2,1.16.3,1.15.6
Release notes:
Which versions are affected by GHSA-7h65-4p22-39j6?
7 open source packages ship an affected version, including github.com/crossplane/crossplane.
| Package | Affected | Fixed in |
|---|---|---|
github.com/crossplane/crossplane Go | From 1.15.5 | 1.15.6, 1.16.3, 1.17.2 |
github.com/crossplane/crossplane Go | From 1.15.5 | 1.15.6 |
github.com/crossplane/crossplane Go | From 1.15.5 | 1.15.6 |
github.com/crossplane/crossplane Go | From 1.16.2 | 1.16.3 |
github.com/crossplane/crossplane Go | From 1.16.2 | 1.16.3 |
github.com/crossplane/crossplane Go | From 1.17.1 | 1.17.2 |
1 more packages
github.com/crossplane/crossplane Go | From 1.17.1 | 1.17.2 |
How do I fix GHSA-7h65-4p22-39j6?
Upgrade github.com/crossplane/crossplane to a fixed version for your release line: 1.15.6, 1.16.3 or 1.17.2.
Is GHSA-7h65-4p22-39j6 being exploited?
There is no known exploitation of GHSA-7h65-4p22-39j6 in the wild and no public exploit code.
Sources
Also known as GO-2024-3219.