CVE-2024-45341

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://go.dev/cl/643099
https://go.dev/issue/71156
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
https://pkg.go.dev/vuln/GO-2025-3373
https://security.netapp.com/advisory/ntap-20250221-0004/

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-28 02:15

Updated : 2026-06-17 07:54

NVD link : CVE-2024-45341

Mitre link : CVE-2024-45341

CVE.ORG link : CVE-2024-45341

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-45341", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-45341", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-28T14:57:00.467281Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@golang.org", "affectedData": [{"vendor": "Go standard library", "product": "crypto/x509", "versions": [{"status": "affected", "version": "0", "lessThan": "1.22.11", "versionType": "semver"}, {"status": "affected", "version": "1.23.0-0", "lessThan": "1.23.5", "versionType": "semver"}, {"status": "affected", "version": "1.24.0-0", "lessThan": "1.24.0-rc.2", "versionType": "semver"}], "packageName": "crypto/x509", "collectionURL": "https://pkg.go.dev", "defaultStatus": "unaffected", "programRoutines": [{"name": "matchURIConstraint"}, {"name": "CertPool.AppendCertsFromPEM"}, {"name": "Certificate.CheckCRLSignature"}, {"name": "Certificate.CheckSignature"}, {"name": "Certificate.CheckSignatureFrom"}, {"name": "Certificate.CreateCRL"}, {"name": "Certificate.Verify"}, {"name": "Certificate.VerifyHostname"}, {"name": "CertificateRequest.CheckSignature"}, {"name": "CreateCertificate"}, {"name": "CreateCertificateRequest"}, {"name": "CreateRevocationList"}, {"name": "DecryptPEMBlock"}, {"name": "EncryptPEMBlock"}, {"name": "HostnameError.Error"}, {"name": "MarshalECPrivateKey"}, {"name": "MarshalPKCS1PrivateKey"}, {"name": "MarshalPKCS1PublicKey"}, {"name": "MarshalPKCS8PrivateKey"}, {"name": "MarshalPKIXPublicKey"}, {"name": "ParseCRL"}, {"name": "ParseCertificate"}, {"name": "ParseCertificateRequest"}, {"name": "ParseCertificates"}, {"name": "ParseDERCRL"}, {"name": "ParseECPrivateKey"}, {"name": "ParsePKCS1PrivateKey"}, {"name": "ParsePKCS1PublicKey"}, {"name": "ParsePKCS8PrivateKey"}, {"name": "ParsePKIXPublicKey"}, {"name": "ParseRevocationList"}, {"name": "RevocationList.CheckSignatureFrom"}, {"name": "SetFallbackRoots"}, {"name": "SystemCertPool"}]}]}], "published": "2025-01-28T02:15:29.147", "references": [{"url": "https://go.dev/cl/643099", "source": "security@golang.org"}, {"url": "https://go.dev/issue/71156", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ", "source": "security@golang.org"}, {"url": "https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ", "source": "security@golang.org"}, {"url": "https://pkg.go.dev/vuln/GO-2025-3373", "source": "security@golang.org"}, {"url": "https://security.netapp.com/advisory/ntap-20250221-0004/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs."}, {"lang": "es", "value": "Un certificado con un URI que tiene una direcci\u00f3n IPv6 con un ID de zona puede satisfacer incorrectamente una restricci\u00f3n de nombre de URI que se aplica a la cadena de certificados. Los certificados que contienen URI no est\u00e1n permitidos en la PKI web, por lo que esto solo afecta a los usuarios de PKI privadas que utilizan URI."}], "lastModified": "2026-06-17T07:54:03.920", "sourceIdentifier": "security@golang.org"}