TI-2024-38975 Aliases GHSA-7jmw-8259-q9jx

Traefik has unexpected behavior with IPv4-mapped IPv6 addresses

LOW 38CWE-180Published 2024-06-11 · Updated 2024-06-17

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact There is a vulnerability in [Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses](https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ). They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms. ### References - [CVE-2024-24790](https://www.cve.org/CVERecord?id=CVE-2024-24790) ### Patches - https://github.com/traefik/traefik/releases/tag/v2.11.4 - https://github.com/traefik/traefik/releases/tag/v3.0.2 ### Workarounds No workaround. ### For more information If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

Why it matters now

Fix Fixed github.com/traefik/traefik/v3 (Go): 3.0.2github.com/traefik/traefik/v2 (Go): 2.11.4+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	github.com/traefik/traefik/v3 (Go)	3.0.0-beta3 to before 3.0.2	3.0.2	Patch available	GHSA-7jmw-8259-q9jx
—	github.com/traefik/traefik/v2 (Go)	before 2.11.4	2.11.4	Patch available	GHSA-7jmw-8259-q9jx
—	github.com/traefik/traefik (Go)	before 2.11.4	2.11.4	Patch available	GHSA-7jmw-8259-q9jx

github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.0.0-beta3 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-7jmw-8259-q9jx
github.com/traefik/traefik/v2 (Go) Vendor— Affected before 2.11.4 Fixed in 2.11.4 Patch available GHSA-7jmw-8259-q9jx
github.com/traefik/traefik (Go) Vendor— Affected before 2.11.4 Fixed in 2.11.4 Patch available GHSA-7jmw-8259-q9jx

Remediation

Fix · GHSA-7jmw-8259-q9jx github.com/traefik/traefik/v3 (Go) Fixed in 3.0.2 Advisory →
Fix · GHSA-7jmw-8259-q9jx github.com/traefik/traefik/v2 (Go) Fixed in 2.11.4 Advisory →
Fix · GHSA-7jmw-8259-q9jx github.com/traefik/traefik (Go) Fixed in 2.11.4 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-7jmw-8259-q9jx

References

Other 6

Sources

GHSA-7jmw-8259-q9jx · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences