Input validation error in Go programming language - CVE-2024-24784

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87201

Input validation error in Go programming language - CVE-2024-24784

Published: March 7, 2024


Vulnerability identifier: #VU87201
CSH Severity: Medium
CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-24784
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to insufficient validation of display names within the ParseAddressList function in net/mail. A remote attacker can pass specially crafted input to the application and perform a spoofing attack.


Affected software

Go programming language
Amazon Linux AMI
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
openSUSE Leap
Ubuntu
openEuler
AdGuard Home
IBM Process Mining
Consul
Consul Enterprise
Run Once Duration Override Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
Kube Descheduler Operator for Red Hat OpenShift
Red Hat Migration Toolkit for Applications
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Operations Dashboard
golang-1.18-src (Ubuntu package)
golang-1.18-go (Ubuntu package)
golang-1.18 (Ubuntu package)
toolbox-tests
toolbox
toolbox (Red Hat package)
udica
conmon-rs (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
butane (Red Hat package)
slirp4netns (Red Hat package)
runc (Red Hat package)
runc
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
openshift-serverless-clients (Red Hat package)
fuse-overlayfs
crun (Red Hat package)
crun
skopeo (Red Hat package)
skopeo-tests
skopeo
golang
golang-help
golang-devel
golang-1.17 (Ubuntu package)
golang-1.17-go (Ubuntu package)
golang-1.17-src (Ubuntu package)
golang-1.21 (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.21-src (Ubuntu package)
delve
go1.21
go1.21-doc
go1.21-race
go-toolset
golang-bin
golang-docs
golang-tests
golang-misc
golang-src
golang (Red Hat package)
golang-shared
go1.21-openssl-race
go1.21-openssl-doc
go1.21-openssl
go1.22-doc
go1.22
go1.22-race
golang-1.22-src (Ubuntu package)
golang-1.22-go (Ubuntu package)
golang-1.22 (Ubuntu package)
dev-lang/go
go1.22-openssl-race
go1.22-openssl-debuginfo
go1.22-openssl-doc
go1.22-openssl
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
buildah-tests
buildah
containers-common (Red Hat package)
containers-common
conmon
conmon (Red Hat package)
oath-toolkit (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux
container-selinux (Red Hat package)
crit
python3-criu
criu-libs
criu-devel
criu
cephadm-ansible (Red Hat package)
libslirp-devel
libslirp
libslirp (Red Hat package)
python3-podman
podman (Red Hat package)
podman-tests
podman
podman-catatonit
podman-gvproxy
podman-plugins
podman-docker
podman-remote
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift4-aws-iso (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
ceph (Red Hat package)
ovn24.03 (Red Hat package)
cockpit-podman
ostree (Red Hat package)
Secondary Scheduler Operator for Red Hat OpenShift (OSSO)
OpenShift API for Data Protection (OADP)
OpenShift Serverless Client
Red Hat OpenShift Container Platform
Red Hat OpenShift Serverless
IBM Cloud Pak System
Watson CP4D Data Stores
Storage Protect Server
Storage Protect Plus Container Agent
Storage Protect Plus Server
Business Automation Insights
Red Hat Ceph Storage

How to mitigate CVE-2024-24784

Install updates from vendor's website.

Go programming language - addressed in versions 1.21.8, 1.22.1
AdGuard Home - update to 0.107.45
IBM Process Mining - update to 1.15.0 IF002
Consul - addressed in versions 1.16.7, 1.17.4
Consul Enterprise - update to 1.18.1
golang-1.18-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox - update to 0.0.99.5-2.0.1
toolbox (Red Hat package) - addressed in versions 0.1.0-2.rhaos4.16.el8, 0.1.2-1.rhaos4.16.el9
udica - update to 0.2.6-21
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.16.el8, 0.6.3-1.rhaos4.16.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.2.gitd5383c5.el9
butane (Red Hat package) - update to 0.21.0-1.rhaos4.16.el8
Run Once Duration Override Operator for Red Hat OpenShift - update to 1.1.1
slirp4netns (Red Hat package) - update to 1.1.8-2.rhaos4.16.el8
runc (Red Hat package) - addressed in versions 1.1.12-3.1.rhaos4.16.el8, 1.1.12-3.1.rhaos4.16.el9
runc - update to 1.1.12-4.0.1
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
Secondary Scheduler Operator for Red Hat OpenShift (OSSO) - update to 1.3.0
OpenShift API for Data Protection (OADP) - update to 1.3.2
containernetworking-plugins (Red Hat package) - update to 1.4.0-2.1.rhaos4.16.el8
containernetworking-plugins - update to 1.4.0-5.0.1
aardvark-dns - update to 1.10.0-2.0.1
fuse-overlayfs (Red Hat package) - update to 1.10-2.rhaos4.16.el8
netavark - update to 1.10.3-1.0.1
openshift-serverless-clients (Red Hat package) - update to 1.12.0-7.el8
fuse-overlayfs - update to 1.13-1.0.1
crun (Red Hat package) - addressed in versions 1.14.3-1.rhaos4.16.el8, 1.14.3-1.rhaos4.16.el9
crun - update to 1.14.3-2
skopeo (Red Hat package) - addressed in versions 1.14.4-1.rhaos4.16.el8, 1.14.4-1.rhaos4.16.el9
skopeo-tests - update to 1.14.5-3.0.1
skopeo - update to 1.14.5-3.0.1
golang - update to 1.15.7-42
golang-help - update to 1.15.7-42
golang-devel - update to 1.15.7-42
golang-1.17 (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17-go (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17-src (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.21 (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-go (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-src (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
delve - update to 1.21.2-3
go1.21 - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21-doc - addressed in versions 1.21.8-1.27.1, 1.21.8-150000.1.27.1
go1.21-race - update to 1.21.8-150000.1.27.1
go-toolset - update to 1.21.9-1
golang-bin - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-docs - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-tests - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-misc - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang-src - addressed in versions 1.21.9-1.0.1, 1.21.10-2
golang (Red Hat package) - update to 1.21.9-2.el9_4
golang-shared - update to 1.21.10-2
go1.21-openssl-race - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-doc - update to 1.21.13.1-150600.16.3.1
go1.21-openssl - update to 1.21.13.1-150600.16.3.1
go1.22-doc - update to 1.22.1-150000.1.9.1
go1.22 - update to 1.22.1-150000.1.9.1
go1.22-race - update to 1.22.1-150000.1.9.1
golang-1.22-src (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22-go (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
dev-lang/go - update to 1.22.3
golang - update to 1.22.3-1
go1.22-openssl-race - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-debuginfo - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-doc - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
cri-tools (Red Hat package) - addressed in versions 1.29.0-3.1.el8, 1.29.0-3.1.el9
cri-o (Red Hat package) - addressed in versions 1.29.5-5.rhaos4.16.git7032128.el8, 1.29.5-5.rhaos4.16.git7032128.el9
OpenShift Serverless Client - update to 1.33.0
Red Hat OpenShift Serverless - update to 1.33.0
buildah (Red Hat package) - addressed in versions 1.33.7-1.1.rhaos4.16.el8, 1.33.7-1.1.rhaos4.16.el9
buildah-tests - addressed in versions 1.33.8-4, 1.34.0-1
buildah - addressed in versions 1.33.8-4, 1.34.0-1
containers-common (Red Hat package) - addressed in versions 1-77.rhaos4.16.el8, 1-77.rhaos4.16.el9
containers-common - update to 1-82.0.1
conmon - update to 2.1.10-1
conmon (Red Hat package) - addressed in versions 2.1.10-2.1.rhaos4.16.el8, 2.1.10-2.1.rhaos4.16.el9
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
haproxy (Red Hat package) - addressed in versions 2.6.13-3.rhaos4.16.el8, 2.8.5-2.rhaos4.16.el9
ignition (Red Hat package) - update to 2.18.0-2.1.rhaos4.16.el9
container-selinux - update to 2.229.0-2
container-selinux (Red Hat package) - addressed in versions 2.231.0-1.rhaos4.16.el8, 2.231.0-1.rhaos4.16.el9
Red Hat OpenShift distributed tracing (RHOSDT) - update to 3.2.0
crit - update to 3.18-5.0.1
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-4.rhaos4.16.el8
Red Hat Advanced Cluster Security for Kubernetes - update to 4.4.2
python3-podman - update to 4.9.0-2
podman (Red Hat package) - addressed in versions 4.9.4-5.1.rhaos4.16.el8, 4.9.4-5.1.rhaos4.16.el9
podman-tests - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-catatonit - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-gvproxy - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-plugins - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-docker - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
podman-remote - addressed in versions 4.9.4-12.0.1, 4.9.4-13.0.1
Red Hat OpenShift Container Platform - addressed in versions 4.13.46, 4.14.34, 4.16.0, 4.16.1
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g26b43df.assembly.stream.el8, 4.16.0-202404181812.p0.g26b43df.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.16.0-202404181812.p0.g7806532.assembly.stream.el8, 4.16.0-202404181812.p0.g7806532.assembly.stream.el9
openshift4-aws-iso (Red Hat package) - update to 4.16.0-202404181812.p0.gd2acdd5.assembly.stream.el8
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202404301345.p0.g0e95532.assembly.stream.el8, 4.16.0-202404301345.p0.g0e95532.assembly.stream.el9
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el8, 4.16.0-202405311136.p0.ga53e9de.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.16.0-202406052127.p0.ga245041.assembly.stream.el8, 4.16.0-202406052127.p0.ga245041.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el8, 4.16.0-202406170957.p0.g29c95f3.assembly.stream.el9
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.0.0
Kube Descheduler Operator for Red Hat OpenShift - update to 5.0.1
Watson CP4D Data Stores - update to 5.1
Red Hat Migration Toolkit for Applications - update to 7.0.3
Red Hat Ceph Storage - update to 8.1
Storage Protect Server - update to 8.1.23
Storage Protect Plus Container Agent - update to 10.1.12.7
Storage Protect Plus Server - update to 10.1.16.2
ceph (Red Hat package) - update to 19.2.1-222.el9cp
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003
Business Automation Insights - update to 24.0.0.0.1
ovn24.03 (Red Hat package) - update to 24.03.2-19.el9fdp
cockpit-podman - update to 84.1-1
IBM Observability with Instana - update to 279
Operations Dashboard - update to 2022.2.1-24
ostree (Red Hat package) - update to 2024.1-2.el9

External References

Related Security Bulletins