# GHSA-7h65-4p22-39j6: github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses > Incorrect handling of IPv4-mapped IPv6 addresses in Go's net/netip package allows bypassing IP-based security checks. - **Severity:** Not scored - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 25 Oct 2024 - **Also known as:** GO-2024-3219 ## What is GHSA-7h65-4p22-39j6? GHSA-7h65-4p22-39j6 is a vulnerability in github.com/crossplane/crossplane, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the `net/netip` package, but the version of golang libraries, runtime, and build tools have still been updated as part of this security advisory nonetheless. **Critical Vulnerabilities** Vulnerability: [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790), `golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses` Description: The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. Affected versions: 1.17.1,1.16.2,1.15.5 See screenshot for more details ![Screenshot from 2024-09-18 17-36-37](https://github.com/user-attachments/assets/2e7ad31f-228a-4534-a4aa-b63d4911351d) Fixed versions: 1.17.2,1.16.3,1.15.6 Release notes: * https://github.com/crossplane/crossplane/releases/tag/v1.17.2 * https://github.com/crossplane/crossplane/releases/tag/v1.16.3 * https://github.com/crossplane/crossplane/releases/tag/v1.15.6 ## Which versions are affected by GHSA-7h65-4p22-39j6? 7 open source packages ship an affected version, including github.com/crossplane/crossplane. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `github.com/crossplane/crossplane` | Go | From 1.15.5 | 1.15.6, 1.16.3, 1.17.2 | | `github.com/crossplane/crossplane` | Go | From 1.15.5 | 1.15.6 | | `github.com/crossplane/crossplane` | Go | From 1.15.5 | 1.15.6 | | `github.com/crossplane/crossplane` | Go | From 1.16.2 | 1.16.3 | | `github.com/crossplane/crossplane` | Go | From 1.16.2 | 1.16.3 | | `github.com/crossplane/crossplane` | Go | From 1.17.1 | 1.17.2 | | `github.com/crossplane/crossplane` | Go | From 1.17.1 | 1.17.2 | ## How do I fix GHSA-7h65-4p22-39j6? Upgrade github.com/crossplane/crossplane to a fixed version for your release line: 1.15.6, 1.16.3 or 1.17.2. ## Is GHSA-7h65-4p22-39j6 being exploited? There is no known exploitation of GHSA-7h65-4p22-39j6 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for GHSA-7h65-4p22-39j6 and fix it if it is affected. What it is: GHSA-7h65-4p22-39j6 is a vulnerability in github.com/crossplane/crossplane, published on 25 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of GHSA-7h65-4p22-39j6 in the wild and no public exploit code. Affected packages and fixed versions: - github.com/crossplane/crossplane (Go): affected from 1.15.5; fixed in 1.15.6, 1.16.3, 1.17.2 - github.com/crossplane/crossplane (Go): affected from 1.15.5; fixed in 1.15.6 - github.com/crossplane/crossplane (Go): affected from 1.15.5; fixed in 1.15.6 - github.com/crossplane/crossplane (Go): affected from 1.16.2; fixed in 1.16.3 - github.com/crossplane/crossplane (Go): affected from 1.16.2; fixed in 1.16.3 - github.com/crossplane/crossplane (Go): affected from 1.17.1; fixed in 1.17.2 - github.com/crossplane/crossplane (Go): affected from 1.17.1; fixed in 1.17.2 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/GHSA-7h65-4p22-39j6/ (Markdown: https://insights.sbomify.com/GHSA-7h65-4p22-39j6/index.md) ``` ## Sources - OSV: https://osv.dev/vulnerability/GHSA-7h65-4p22-39j6 --- From sbomify Insights: https://insights.sbomify.com/GHSA-7h65-4p22-39j6/ Summaries are generated and may contain mistakes; the official description above is the record.