HIGH7.5

GO-2024-2609

Comments in display names are incorrectly handled in net/mail

Quick fix

GO-2024-2609 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.21.8

Details

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.21.8

Fixgo get stdlib@v1.21.8

References

https://go.dev/issue/65083[REPORT]
https://go.dev/cl/555596[FIX]
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg[WEB]