Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-45341

Date: January 27, 2025

GO Security Advisory - crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. This is fixed in Go 1.23.5 and Go 1.22.11.

Severity Score

Related Resources (9)

https://go.dev/cl/643099
https://security.netapp.com/advisory/ntap-20250221-0004/
https://pkg.go.dev/vuln/GO-2025-3373
https://nvd.nist.gov/vuln/detail/CVE-2024-45341
https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
https://seclists.org/oss-sec/2025/q1/28
https://go.dev/issue/71156
https://www.mend.io/vulnerability-database/CVE-2024-45341

Severity Score

Weakness Type (CWE)

Improper Certificate Validation

CWE-295

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us