CVE-2024-24784

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/03/08/4
https://go.dev/cl/555596
https://go.dev/issue/65083
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
https://pkg.go.dev/vuln/GO-2024-2609
https://security.netapp.com/advisory/ntap-20240329-0007/
http://www.openwall.com/lists/oss-security/2024/03/08/4
https://go.dev/cl/555596
https://go.dev/issue/65083
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
https://pkg.go.dev/vuln/GO-2024-2609
https://security.netapp.com/advisory/ntap-20240329-0007/

Configurations

No configuration.

History

No history.

Information

Published : 2024-03-05 23:15

Updated : 2026-06-17 07:14

NVD link : CVE-2024-24784

Mitre link : CVE-2024-24784

CVE.ORG link : CVE-2024-24784

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-24784", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-24784", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-05T20:13:24.512123Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "net/mail", "versions": [{"status": "affected", "version": "0", "lessThan": "1.21.8", "versionType": "semver"}, {"status": "affected", "version": "1.22.0-0", "lessThan": "1.22.1", "versionType": "semver"}], "packageName": "net/mail", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "addrParser.consumeGroupList"}, {"name": "addrParser.consumePhrase"}, {"name": "isAtext"}, {"name": "Address.String"}, {"name": "AddressParser.Parse"}, {"name": "AddressParser.ParseList"}, {"name": "Header.AddressList"}, {"name": "ParseAddress"}, {"name": "ParseAddressList"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:go_standard_library:net\\/mail:*:*:*:*:*:*:*:*"], "vendor": "go_standard_library", "product": "net\\/mail", "versions": [{"status": "affected", "version": "0", "lessThan": "1.21.8", "versionType": "semver"}, {"status": "affected", "version": "1.22.0-0", "lessThan": "1.22.1", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2024-03-05T23:15:07.733", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "source": "security@golang.org"}, {"url": "https://go.dev/cl/555596", "source": "security@golang.org"}, {"url": "https://go.dev/issue/65083", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2609", "source": "security@golang.org"}, {"url": "https://security.netapp.com/advisory/ntap-20240329-0007/", "source": "security@golang.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://go.dev/cl/555596", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://go.dev/issue/65083", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pkg.go.dev/vuln/GO-2024-2609", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240329-0007/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers."}, {"lang": "es", "value": "La funci\u00f3n ParseAddressList controla incorrectamente los comentarios (texto entre par\u00e9ntesis) dentro de los nombres para mostrar. Dado que se trata de una desalineaci\u00f3n con los analizadores de direcciones conformes, puede dar lugar a que los programas que utilizan diferentes analizadores tomen diferentes decisiones de confianza."}], "lastModified": "2026-06-17T07:14:51.213", "sourceIdentifier": "security@golang.org"}