GHSA-7jmw-8259-q9jx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7jmw-8259-q9jx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-7jmw-8259-q9jx
- Aliases
- Published
- 2024-06-11T19:29:43Z
- Modified
- 2026-07-17T21:12:39Z
- Summary
- Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
- Details
-
Impact
There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
- Database specific
{ "cwe_ids": [ "CWE-180" ], "github_reviewed": true, "github_reviewed_at": "2024-06-11T19:29:43Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.4
- https://github.com/traefik/traefik/releases/tag/v3.0.2
- https://pkg.go.dev/vuln/GO-2024-2917
- https://www.cve.org/CVERecord?id=CVE-2024-24790
Affected packages
Go / github.com/traefik/traefik/v3
Package
- Name
- github.com/traefik/traefik/v3
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/traefik/traefik/v3
Go / github.com/traefik/traefik/v2
Package
- Name
- github.com/traefik/traefik/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/traefik/traefik/v2
Go / github.com/traefik/traefik
Package
- Name
- github.com/traefik/traefik
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/traefik/traefik