CVE-2024-45341 (GCVE-0-2024-45341)

Vulnerability from cvelistv5 – Published: 2025-01-28 01:03 – Updated: 2025-02-21 18:03
VLAI
Title
Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
Summary
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.
Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-01-28 14:57 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
Go
References
Impacted products
Vendor Product Version
Go standard library crypto/x509 Affected: 0 , < 1.22.11 (semver)
Affected: 1.23.0-0 , < 1.23.5 (semver)
Affected: 1.24.0-0 , < 1.24.0-rc.2 (semver)
Create a notification for this product.
Credits
Juho Forsén of Mattermost
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45341",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-28T14:57:00.467281Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-28T15:16:58.278Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-02-21T18:03:33.296Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://security.netapp.com/advisory/ntap-20250221-0004/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "matchURIConstraint"
            },
            {
              "name": "CertPool.AppendCertsFromPEM"
            },
            {
              "name": "Certificate.CheckCRLSignature"
            },
            {
              "name": "Certificate.CheckSignature"
            },
            {
              "name": "Certificate.CheckSignatureFrom"
            },
            {
              "name": "Certificate.CreateCRL"
            },
            {
              "name": "Certificate.Verify"
            },
            {
              "name": "Certificate.VerifyHostname"
            },
            {
              "name": "CertificateRequest.CheckSignature"
            },
            {
              "name": "CreateCertificate"
            },
            {
              "name": "CreateCertificateRequest"
            },
            {
              "name": "CreateRevocationList"
            },
            {
              "name": "DecryptPEMBlock"
            },
            {
              "name": "EncryptPEMBlock"
            },
            {
              "name": "HostnameError.Error"
            },
            {
              "name": "MarshalECPrivateKey"
            },
            {
              "name": "MarshalPKCS1PrivateKey"
            },
            {
              "name": "MarshalPKCS1PublicKey"
            },
            {
              "name": "MarshalPKCS8PrivateKey"
            },
            {
              "name": "MarshalPKIXPublicKey"
            },
            {
              "name": "ParseCRL"
            },
            {
              "name": "ParseCertificate"
            },
            {
              "name": "ParseCertificateRequest"
            },
            {
              "name": "ParseCertificates"
            },
            {
              "name": "ParseDERCRL"
            },
            {
              "name": "ParseECPrivateKey"
            },
            {
              "name": "ParsePKCS1PrivateKey"
            },
            {
              "name": "ParsePKCS1PublicKey"
            },
            {
              "name": "ParsePKCS8PrivateKey"
            },
            {
              "name": "ParsePKIXPublicKey"
            },
            {
              "name": "ParseRevocationList"
            },
            {
              "name": "RevocationList.CheckSignatureFrom"
            },
            {
              "name": "SetFallbackRoots"
            },
            {
              "name": "SystemCertPool"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.22.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.23.5",
              "status": "affected",
              "version": "1.23.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.0-rc.2",
              "status": "affected",
              "version": "1.24.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Juho Fors\u00e9n of Mattermost"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T19:14:21.421Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/643099"
        },
        {
          "url": "https://go.dev/issue/71156"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ"
        },
        {
          "url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3373"
        }
      ],
      "title": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-45341",
    "datePublished": "2025-01-28T01:03:24.353Z",
    "dateReserved": "2024-08-27T19:41:58.556Z",
    "dateUpdated": "2025-02-21T18:03:33.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-45341",
      "date": "2026-08-14",
      "epss": "0.00466",
      "percentile": "0.38312"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-26T01:35:59.000Z",
      "cve": "CVE-2024-45341",
      "id": "msrc_CVE-2024-45341",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "7",
      "product_status:known_affected": "13",
      "product_status:known_not_affected": "9",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-45341.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45341\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2025-01-28T02:15:29.147\",\"lastModified\":\"2026-06-17T07:54:03.920\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.\"},{\"lang\":\"es\",\"value\":\"Un certificado con un URI que tiene una direcci\u00f3n IPv6 con un ID de zona puede satisfacer incorrectamente una restricci\u00f3n de nombre de URI que se aplica a la cadena de certificados. Los certificados que contienen URI no est\u00e1n permitidos en la PKI web, por lo que esto solo afecta a los usuarios de PKI privadas que utilizan URI.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"crypto/x509\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"crypto/x509\",\"programRoutines\":[{\"name\":\"matchURIConstraint\"},{\"name\":\"CertPool.AppendCertsFromPEM\"},{\"name\":\"Certificate.CheckCRLSignature\"},{\"name\":\"Certificate.CheckSignature\"},{\"name\":\"Certificate.CheckSignatureFrom\"},{\"name\":\"Certificate.CreateCRL\"},{\"name\":\"Certificate.Verify\"},{\"name\":\"Certificate.VerifyHostname\"},{\"name\":\"CertificateRequest.CheckSignature\"},{\"name\":\"CreateCertificate\"},{\"name\":\"CreateCertificateRequest\"},{\"name\":\"CreateRevocationList\"},{\"name\":\"DecryptPEMBlock\"},{\"name\":\"EncryptPEMBlock\"},{\"name\":\"HostnameError.Error\"},{\"name\":\"MarshalECPrivateKey\"},{\"name\":\"MarshalPKCS1PrivateKey\"},{\"name\":\"MarshalPKCS1PublicKey\"},{\"name\":\"MarshalPKCS8PrivateKey\"},{\"name\":\"MarshalPKIXPublicKey\"},{\"name\":\"ParseCRL\"},{\"name\":\"ParseCertificate\"},{\"name\":\"ParseCertificateRequest\"},{\"name\":\"ParseCertificates\"},{\"name\":\"ParseDERCRL\"},{\"name\":\"ParseECPrivateKey\"},{\"name\":\"ParsePKCS1PrivateKey\"},{\"name\":\"ParsePKCS1PublicKey\"},{\"name\":\"ParsePKCS8PrivateKey\"},{\"name\":\"ParsePKIXPublicKey\"},{\"name\":\"ParseRevocationList\"},{\"name\":\"RevocationList.CheckSignatureFrom\"},{\"name\":\"SetFallbackRoots\"},{\"name\":\"SystemCertPool\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.22.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.23.0-0\",\"lessThan\":\"1.23.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.24.0-0\",\"lessThan\":\"1.24.0-rc.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-01-28T14:57:00.467281Z\",\"id\":\"CVE-2024-45341\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://go.dev/cl/643099\",\"source\":\"security@golang.org\"},{\"url\":\"https://go.dev/issue/71156\",\"source\":\"security@golang.org\"},{\"url\":\"https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ\",\"source\":\"security@golang.org\"},{\"url\":\"https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ\",\"source\":\"security@golang.org\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2025-3373\",\"source\":\"security@golang.org\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250221-0004/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-12T21:46:44+00:00",
      "cve": "CVE-2024-45341",
      "id": "CVE-2024-45341",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:fixed": "88",
      "product_status:known_affected": "794",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45341.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:57:02Z",
      "cve": "CVE-2024-45341",
      "id": "CVE-2024-45341",
      "initial_release_date": "2025-01-20T03:52:42Z",
      "product_status:known_affected": "21",
      "product_status:known_not_affected": "67",
      "product_status:recommended": "361",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-45341",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-45341.json",
      "version": "42"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://security.netapp.com/advisory/ntap-20250221-0004/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-02-21T18:03:33.296Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45341\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-28T14:57:00.467281Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-28T14:47:13.751Z\"}}], \"cna\": {\"title\": \"Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509\", \"credits\": [{\"lang\": \"en\", \"value\": \"Juho Fors\\u00e9n of Mattermost\"}], \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"crypto/x509\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.22.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.23.0-0\", \"lessThan\": \"1.23.5\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.24.0-0\", \"lessThan\": \"1.24.0-rc.2\", \"versionType\": \"semver\"}], \"packageName\": \"crypto/x509\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"matchURIConstraint\"}, {\"name\": \"CertPool.AppendCertsFromPEM\"}, {\"name\": \"Certificate.CheckCRLSignature\"}, {\"name\": \"Certificate.CheckSignature\"}, {\"name\": \"Certificate.CheckSignatureFrom\"}, {\"name\": \"Certificate.CreateCRL\"}, {\"name\": \"Certificate.Verify\"}, {\"name\": \"Certificate.VerifyHostname\"}, {\"name\": \"CertificateRequest.CheckSignature\"}, {\"name\": \"CreateCertificate\"}, {\"name\": \"CreateCertificateRequest\"}, {\"name\": \"CreateRevocationList\"}, {\"name\": \"DecryptPEMBlock\"}, {\"name\": \"EncryptPEMBlock\"}, {\"name\": \"HostnameError.Error\"}, {\"name\": \"MarshalECPrivateKey\"}, {\"name\": \"MarshalPKCS1PrivateKey\"}, {\"name\": \"MarshalPKCS1PublicKey\"}, {\"name\": \"MarshalPKCS8PrivateKey\"}, {\"name\": \"MarshalPKIXPublicKey\"}, {\"name\": \"ParseCRL\"}, {\"name\": \"ParseCertificate\"}, {\"name\": \"ParseCertificateRequest\"}, {\"name\": \"ParseCertificates\"}, {\"name\": \"ParseDERCRL\"}, {\"name\": \"ParseECPrivateKey\"}, {\"name\": \"ParsePKCS1PrivateKey\"}, {\"name\": \"ParsePKCS1PublicKey\"}, {\"name\": \"ParsePKCS8PrivateKey\"}, {\"name\": \"ParsePKIXPublicKey\"}, {\"name\": \"ParseRevocationList\"}, {\"name\": \"RevocationList.CheckSignatureFrom\"}, {\"name\": \"SetFallbackRoots\"}, {\"name\": \"SystemCertPool\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/643099\"}, {\"url\": \"https://go.dev/issue/71156\"}, {\"url\": \"https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ\"}, {\"url\": \"https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2025-3373\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-295: Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2025-01-30T19:14:21.421Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45341\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-21T18:03:33.296Z\", \"dateReserved\": \"2024-08-27T19:41:58.556Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2025-01-28T01:03:24.353Z\", \"assignerShortName\": \"Go\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.