Fluid Attacks Database

Description

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	stdlib	>=0 <1.21.8	1.21.8
debian 11	golang-1.15	=1.15.15-1 \|\| =1.15.15-1~deb11u1 \|\| =1.15.15-1~deb11u2 \|\| =1.15.15-1~deb11u3 \|\| =1.15.15-1~deb11u4 \|\| =1.15.15-2 \|\| =1.15.15-3 \|\| =1.15.15-4 \|\| =1.15.15-5 \|\| =1.15.9-6	-
debian 12	golang-1.19	=1.19.10-1 \|\| =1.19.10-2 \|\| =1.19.11-1 \|\| =1.19.12-1 \|\| =1.19.12-2 \|\| =1.19.12-2~bpo11+1 \|\| =1.19.12-2~bpo12+1 \|\| =1.19.13-1 \|\| =1.19.13-1~bpo11+1 \|\| =1.19.13-1~bpo12+1 \|\| =1.19.8-2 \|\| =1.19.9-1	-
rpm rhel8	osbuild-composer	-	-
rpm rhel8	go-toolset	<0:1.21.9-1.module+el8.10.0+21671+b35c3b78	0:1.21.9-1.module+el8.10.0+21671+b35c3b78
rpm rhel9	osbuild-composer	-	-
rpm rhel9	grafana	-	-
rpm rhel9	golang	<0:1.21.9-2.el9_4	0:1.21.9-2.el9_4
rpm rhel8	grafana	-	-
rpm rhel9	skopeo	-	-

Aliases

1. CVE-2024-247842. NVD-2024-247843. OSV-GO-2024-26094. OSV-2024-247845. OSV-DEBIAN-2024-247846. GCVE-2024-247847. SECURITY-TRACKER-CVE-2024-24784

References

1. https://go.dev/issue/650832. https://go.dev/cl/5555963. https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.