CVE-2024-24784: Comments in display names are incorrectly handled in net/mail
Comments in display names are incorrectly handled in net/mail
Other sources
Golang Go is vulnerable to a denial of service, caused by a flaw in the crypto/x509 package when verifying a certificate chain. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause Certificate.Verify to panic, and results in a denial of service condition.
— IBM
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.21.8 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.22.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.21.6-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24784?
CVE-2024-24784 is classified as a denial of service vulnerability which can lead to application crashes.
How do I fix CVE-2024-24784?
To fix CVE-2024-24784, update affected Go packages to the recommended versions, such as Go 1.21.8 or 1.22.1.
Which versions of Go are affected by CVE-2024-24784?
CVE-2024-24784 affects Go versions up to and including 1.21.7 and various other specific versions in the affected software.
Can CVE-2024-24784 be exploited remotely?
Yes, CVE-2024-24784 can be exploited remotely by sending specially crafted requests to the vulnerable application.
What impact does CVE-2024-24784 have on applications?
CVE-2024-24784 can cause applications to panic during certificate chain verification, resulting in a denial of service.