CVE-2024-24784

HIGH7.5

Description

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected products

Go standard library / net/mail0 – 1.21.8
Go standard library / net/mail1.22.0-0 – 1.22.1

References

MISChttps://go.dev/issue/65083
MISChttps://go.dev/cl/555596
MISChttps://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
MISChttps://pkg.go.dev/vuln/GO-2024-2609
MISChttps://security.netapp.com/advisory/ntap-20240329-0007/
MAILING_LISThttp://www.openwall.com/lists/oss-security/2024/03/08/4

Updated 8m ago · 8 sources