Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] #71156

Closed
rolandshoemaker opened this issue Jan 7, 2025 · 6 comments
Closed

crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] #71156

rolandshoemaker opened this issue Jan 7, 2025 · 6 comments
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security
Milestone
Go1.24

Comments

@rolandshoemaker
Copy link
Member

rolandshoemaker commented Jan 7, 2025 •
edited by mknyszek
Loading

A certificate with a URI which has a IPv6 address with a zone ID may
incorrectly satisfy a URI name constraint that applies to the certificate
chain.

Certificates containing URIs are not permitted in the web PKI, so this
only affects users of private PKIs which make use of URIs.

Thanks to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2024-45341.

Tracked in http://b/379881511 and fixed by https://go-internal-review.git.corp.google.com/c/go/+/1700.

/cc @golang/security and @golang/release
This was referenced Jan 7, 2025
Closed
Closed
@gabyhelp gabyhelp added the BugReport Issues describing a possible bug in the Go implementation. label Jan 7, 2025
@prattmic prattmic added the NeedsFix The path to resolution is known, but the work has not been done. label Jan 8, 2025
@neild
Copy link
Contributor

neild commented Jan 9, 2025

@gopherbot please open backport issues for 1.22, 1.23, and 1.24

@gopherbot gopherbot mentioned this issue Jan 9, 2025
Closed
@gopherbot
Copy link
Contributor

Backport issue(s) opened: #71207 (for 1.22), #71208 (for 1.23), #71209 (for 1.24).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

This was referenced Jan 9, 2025
Closed
Closed
@gabyhelp gabyhelp mentioned this issue Jan 10, 2025
Closed
@rolandshoemaker rolandshoemaker removed the BugReport Issues describing a possible bug in the Go implementation. label Jan 15, 2025
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643096 mentions this issue: crypto/x509: properly check for IPv6 hosts in URIs

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643105 mentions this issue: [release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in URIs

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643103 mentions this issue: [release-branch.go1.23] crypto/x509: properly check for IPv6 hosts in URIs

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/643099 mentions this issue: crypto/x509: properly check for IPv6 hosts in URIs

gopherbot pushed a commit that referenced this issue Jan 16, 2025
@rolandshoemaker @gopherbot
[release-branch.go1.23] crypto/x509: properly check for IPv6 hosts in…
fdb8413 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For #71156
Fixes #71208
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1762
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643103
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
gopherbot pushed a commit that referenced this issue Jan 16, 2025
@rolandshoemaker @gopherbot
[release-branch.go1.22] crypto/x509: properly check for IPv6 hosts in…
19d2103 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For #71156
Fixes #71207
Fixes CVE-2024-45341

Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Change-Id: I1d97723e0f29fcf1404fb868ba0495282da70f6e
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1780
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643105
TryBot-Bypass: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
gopherbot pushed a commit that referenced this issue Jan 16, 2025
@rolandshoemaker @gopherbot
[release-branch.go1.24] crypto/x509: properly check for IPv6 hosts in…
468fad4 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For #71156
Fixes #71209
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1800
Commit-Queue: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643099
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
@mknyszek mknyszek changed the title security: fix CVE-2024-45341 crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints [CVE-2024-45341] Jan 16, 2025
@dmitshur dmitshur added this to the Go1.24 milestone Jan 16, 2025
@dmitshur dmitshur marked this as a duplicate of #71209 Jan 16, 2025
wyf9661 pushed a commit to wyf9661/go that referenced this issue Jan 21, 2025
@rolandshoemaker @wyf9661
[release-branch.go1.24] crypto/x509: properly check for IPv6 hosts in…
b3c79a3 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For golang#71156
Fixes golang#71209
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1800
Commit-Queue: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643099
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
mpminardi pushed a commit to tailscale/go that referenced this issue Jan 28, 2025
@rolandshoemaker @mpminardi
[release-branch.go1.23] crypto/x509: properly check for IPv6 hosts in…
0c34d08 
… URIs

When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

For golang#71156
Fixes golang#71208
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
(cherry picked from commit 22ca55d396ba801e6ae9b2bd67a059fcb30562fd)
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1762
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643103
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Clement-Jean pushed a commit to Clement-Jean/go that referenced this issue Jan 31, 2025
@rolandshoemaker @Clement-Jean
crypto/x509: properly check for IPv6 hosts in URIs
a724875 
When checking URI constraints, use netip.ParseAddr, which understands
zones, unlike net.ParseIP which chokes on them. This prevents zone IDs
from mistakenly satisfying URI constraints.

Thanks to Juho Forsén of Mattermost for reporting this issue.

Fixes golang#71156
Fixes CVE-2024-45341

Change-Id: Iecac2529f3605382d257996e0fb6d6983547e400
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/1700
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/643096
Reviewed-by: Michael Pratt <mpratt@google.com>
Auto-Submit: Michael Knyszek <mknyszek@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsFix The path to resolution is known, but the work has not been done. Security
Projects
None yet
Milestone
Go1.24
Development

No branches or pull requests
6 participants
@neild @prattmic @dmitshur @rolandshoemaker @gopherbot @gabyhelp