CVE-2024-45341: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
First published: Thu Jan 23 2025(Updated: )
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/643099
- https://go.dev/issue/71156
- https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
- https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
- https://pkg.go.dev/vuln/GO-2025-3373
- https://security.netapp.com/advisory/ntap-20250221-0004/
- https://access.redhat.com/errata/RHSA-2025:3772
- https://bugzilla.redhat.com/show_bug.cgi?id=2341750
- https://www.ibm.com/support/pages/node/7232197 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-45341?
CVE-2024-45341 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-45341?
To fix CVE-2024-45341, ensure that you avoid using certificates containing URIs with IPv6 addresses in private PKIs.
Who is affected by CVE-2024-45341?
CVE-2024-45341 primarily affects users of private PKIs that implement certificates with URIs.
What kind of certificates are impacted by CVE-2024-45341?
CVE-2024-45341 impacts certificates that contain URIs with IPv6 addresses including zone IDs.
Is CVE-2024-45341 a threat to web PKI users?
No, CVE-2024-45341 does not affect web PKI users since certificates with URIs are not permitted in the web PKI.
- agent/weakness
- agent/title
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/references
- agent/source
- agent/severity
- agent/first-publish-date
- agent/softwarecombine
- agent/description
- agent/trending
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-45341
- agent/last-modified-date
- collector/ibm-support
- source/IBM