GO-2024-2887

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2024-2887

Import Source

https://vuln.go.dev/ID/GO-2024-2887.json

JSON Data

https://api.test.osv.dev/v1/vulns/GO-2024-2887

Aliases

Published

2024-06-04T22:48:55Z

Modified

2024-07-15T22:42:20.100088Z

Summary

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Details

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

Database specific

{
    "url": "https://pkg.go.dev/vuln/GO-2024-2887",
    "review_status": "REVIEWED"
}

References

Credits

- Enze Wang of Alioth (@zer0yu)
- Jianjun Chen of Zhongguancun Lab (@chenjj)

Affected packages

Go / stdlib

Package

Name: stdlib; View open source insights on deps.dev
Purl: pkg:golang/stdlib

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.21.11

Introduced

1.22.0-0

Fixed

1.22.4

Ecosystem specific

{
    "imports": [
        {
            "path": "net/netip",
            "symbols": [
                "Addr.IsGlobalUnicast",
                "Addr.IsInterfaceLocalMulticast",
                "Addr.IsLinkLocalMulticast",
                "Addr.IsLoopback",
                "Addr.IsMulticast",
                "Addr.IsPrivate"
            ]
        }
    ]
}