Vulnerability · Published Jan 28, 2025 · Assigned by Go
CVE-2024-45341Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
Medium 6.1
In plain English
A medium-severity security flaw in crypto/x509 from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | delve | 1.24.1-1.el10_0 | ALSA-2025:7466 |
| AlmaLinux:8 | delve | 1.24.1-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:9 | git-lfs | 3.7.1-4.el9_8 | ALSA-2026:19350 |
| AlmaLinux:10 | go-toolset | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | go-toolset | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang-bin | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang-bin | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang-docs | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang-docs | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang-misc | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang-misc | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang-src | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang-src | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| AlmaLinux:10 | golang-tests | 1.23.7-1.el10_0.alma.1 | ALSA-2025:7466 |
| AlmaLinux:8 | golang-tests | 1.23.6-1.module_el8.10.0+3977+66935a26 | ALSA-2025:3772 |
| Alpine:v3.21 | go | 1.23.5-r0 | ALPINE-CVE-2024-45341 |
| Alpine:v3.22 | go | 1.23.5-r0 | ALPINE-CVE-2024-45341 |
| Alpine:v3.23 | go | 1.23.5-r0 | ALPINE-CVE-2024-45341 |
| Alpine:v3.24 | go | 1.23.5-r0 | ALPINE-CVE-2024-45341 |
| Debian:12 | golang-1.19 | no fix listed | DEBIAN-CVE-2024-45341 |
| Debian:13 | golang-1.24 | 1.24~rc2-1 | DEBIAN-CVE-2024-45341 |
| Go | stdlib | 1.22.11, 1.23.5, 1.24.0-rc.2 | GO-2025-3373 |
| Rocky Linux:10 | delve | 0:1.24.1-1.el10_0 | RLSA-2025:7466 |
| Rocky Linux:8 | delve | 0:1.24.1-1.module+el8.10.0+1987+42f155bb | RLSA-2025:3772 |
| Rocky Linux:8 | delve | 0:1.24.1-1.module+el8.10.0+1951+c74bd827 | RLSA-2025:3772 |
| Rocky Linux:9 | delve | 0:1.24.1-2.el9_6 | RLSA-2025:3773 |
| Rocky Linux:8 | go-toolset | 0:1.23.6-1.module+el8.10.0+1951+c74bd827 | RLSA-2025:3772 |
| Rocky Linux:10 | golang | 0:1.23.7-1.el10_0 | RLSA-2025:7466 |
| Rocky Linux:8 | golang | 0:1.23.6-1.module+el8.10.0+1951+c74bd827 | RLSA-2025:3772 |
| Rocky Linux:9 | golang | 0:1.23.6-2.el9_6 | RLSA-2025:3773 |
| Ubuntu:22.04:LTS | golang-1.17 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.18 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.20 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:24.04:LTS | golang-1.21 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.22 | 1.22.2-2~22.04.3 | USN-7574-1 |
| Ubuntu:22.04:LTS | golang-1.22 | 1.22.2-2~22.04.3 | UBUNTU-CVE-2024-45341 |
| Ubuntu:24.04:LTS | golang-1.22 | 1.22.2-2ubuntu0.4 | USN-7574-1 |
| Ubuntu:24.04:LTS | golang-1.22 | 1.22.2-2ubuntu0.4 | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:24.04:LTS | golang-1.23 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:22.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:24.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:25.10 | golang-1.24 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:26.04:LTS | golang-1.24 | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:25.10 | golang-go.crypto | no fix listed | UBUNTU-CVE-2024-45341 |
| Ubuntu:26.10 | golang-go.crypto | no fix listed | UBUNTU-CVE-2024-45341 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | crypto/x509 | 0 – before 1.22.111.23.0-0 – before 1.23.51.24.0-0 – before 1.24.0-rc.2 |