Vulnerability · Published Jul 3, 2024 · Assigned by Google
CVE-2024-6284Improper IPv4 and IPv6 byte order storage in github.com/google/nftables
Medium 6.3
In plain English
A medium-severity security flaw in https://github.com/google/nftables from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work as intended (might block or not block the desired addresses). This issue affects: https://pkg.go.dev/github.com/google/nftables@v0.1.0 The bug was fixed in the next released version: https://pkg.go.dev/github.com/google/nftables@v0.2.0
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-google-nftables | 0.1.0-4~deb12u1 | DEBIAN-CVE-2024-6284 |
| Debian:13 | golang-github-google-nftables | 0.1.0-4 | DEBIAN-CVE-2024-6284 |
| Debian:14 | golang-github-google-nftables | 0.1.0-4 | DEBIAN-CVE-2024-6284 |
| Go | github.com/google/nftables | 0.2.0 | GHSA-qjvf-8748-9w7h |
| Go | github.com/google/nftables | 0.2.0 | GO-2024-2977 |
| Ubuntu:24.04:LTS | golang-github-google-nftables | no fix listed | UBUNTU-CVE-2024-6284 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| https://github.com/google/nftables | 0.1.0 |
Weakness: CWE-1286, CWE-1389 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L