Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] [1.24 backport] #71209

Closed
gopherbot opened this issue Jan 9, 2025 · 1 comment
Closed

crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] [1.24 backport] #71209

gopherbot opened this issue Jan 9, 2025 · 1 comment
Labels
CherryPickCandidate Used during the release process for point releases Security

Comments

@gopherbot
Copy link
Contributor

@neild requested issue #71156 to be considered for backport to the next 1.24 minor release.

@gopherbot please open backport issues for 1.22, 1.23, and 1.24
@gopherbot gopherbot added CherryPickCandidate Used during the release process for point releases Security labels Jan 9, 2025
@gopherbot gopherbot mentioned this issue Jan 9, 2025
Closed
@gopherbot
Copy link
Contributor Author

Change https://go.dev/cl/643099 mentions this issue: crypto/x509: properly check for IPv6 hosts in URIs

gopherbot pushed a commit that referenced this issue Jan 16, 2025
@rolandshoemaker @gopherbot
[release-branch.go1.24] crypto/x509: properly check for IPv6 hosts in…
468fad4 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For #71156
Fixes #71209
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1800
Commit-Queue: Roland Shoemaker <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643099
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
@mknyszek mknyszek changed the title security: fix CVE-2024-45341 [1.24 backport] crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] [1.24 backport] Jan 16, 2025
wyf9661 pushed a commit to wyf9661/go that referenced this issue Jan 21, 2025
@rolandshoemaker @wyf9661
[release-branch.go1.24] crypto/x509: properly check for IPv6 hosts in…
b3c79a3 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For golang#71156
Fixes golang#71209
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <[email protected]>
Reviewed-by: Damien Neil <[email protected]>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1800
Commit-Queue: Roland Shoemaker <[email protected]>
Reviewed-by: Roland Shoemaker <[email protected]>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643099
LUCI-TryBot-Result: Go LUCI <[email protected]>
Auto-Submit: Michael Knyszek <[email protected]>
Reviewed-by: Michael Pratt <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
CherryPickCandidate Used during the release process for point releases Security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dmitshur @gopherbot