GHSA-7jmw-8259-q9jx
Traefik has unexpected behavior with IPv4-mapped IPv6 addresses
Quick fix
GHSA-7jmw-8259-q9jx — github.com/traefik/traefik/v3: upgrade to the fixed version with the command below.
go get github.com/traefik/traefik/v3@v3.0.2Details
### Impact
There is a vulnerability in [Go managing various Is methods (IsPrivate, IsLoopback, etc) for IPv4-mapped IPv6 addresses](https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ).
They didn't work as expected returning false for addresses which would return true in their traditional IPv4 forms.
### References
- [CVE-2024-24790](https://www.cve.org/CVERecord?id=CVE-2024-24790)
### Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.4 - https://github.com/traefik/traefik/releases/tag/v3.0.2
### Workarounds
No workaround.
### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).
Are you affected?
Enter the version of the package you're using.
Affected packages
3.0.0-beta3 Fixed in: 3.0.2 go get github.com/traefik/traefik/v3@v3.0.2 0 Fixed in: 2.11.4 go get github.com/traefik/traefik/v2@v2.11.4 0 Fixed in: 2.11.4 go get github.com/traefik/traefik@v2.11.4 References
- https://github.com/traefik/traefik/security/advisories/GHSA-7jmw-8259-q9jx [WEB]
- https://github.com/traefik/traefik [PACKAGE]
- https://github.com/traefik/traefik/releases/tag/v2.11.4 [WEB]
- https://github.com/traefik/traefik/releases/tag/v3.0.2 [WEB]
- https://pkg.go.dev/vuln/GO-2024-2917 [WEB]
- https://www.cve.org/CVERecord?id=CVE-2024-24790 [WEB]