GHSA-7jmw-8259-q9jx

Suggest an improvement
Source
https://github.com/advisories/GHSA-7jmw-8259-q9jx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-7jmw-8259-q9jx/GHSA-7jmw-8259-q9jx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-7jmw-8259-q9jx
Aliases
Related
Published
2024-06-11T19:29:43Z
Modified
2024-07-15T22:00:21.535008Z
Summary
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
Details

Impact

There is a vulnerability in Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses.

They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.

References

Patches

  • https://github.com/traefik/traefik/releases/tag/v2.11.4
  • https://github.com/traefik/traefik/releases/tag/v3.0.2

Workarounds

No workaround.

For more information

If you have any questions or comments about this advisory, please open an issue.

References

Affected packages

Go / github.com/traefik/traefik/v3

Package

Name
github.com/traefik/traefik/v3
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v3

Affected ranges

Type
SEMVER
Events
Introduced
3.0.0-beta3
Fixed
3.0.2

Go / github.com/traefik/traefik/v2

Package

Name
github.com/traefik/traefik/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik/v2

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.11.4

Go / github.com/traefik/traefik

Package

Name
github.com/traefik/traefik
View open source insights on deps.dev
Purl
pkg:golang/github.com/traefik/traefik

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.11.4