net-mail up to 1.21.7/1.22.0 on Go Display Name ParseAddressList neutralization

Summaryinfo

A vulnerability has been found in net-mail up to 1.21.7/1.22.0 on Go and classified as problematic. Affected by this issue is the function ParseAddressList of the component Display Name Handler. The manipulation leads to neutralization. This vulnerability is traded as CVE-2024-24784. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in net-mail up to 1.21.7/1.22.0 on Go and classified as problematic. This issue affects the function ParseAddressList of the component Display Name Handler. The manipulation with an unknown input leads to a neutralization vulnerability. Using CWE to declare the problem leads to CWE-707. The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component. Impacted is integrity. The summary by CVE is:

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

The weakness was shared 03/06/2024. The identification of this vulnerability is CVE-2024-24784 since 01/30/2024. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 207754 (AlmaLinux 8 : container-tools:rhel8 (ALSA-2024:6969)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.21.8 or 1.22.1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (207754) and CERT Bund (WID-SEC-2024-0560). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• Gentoo Linux
• Xerox FreeFlow Print Server
• RESF Rocky Linux
• Golang Go
• IBM Spectrum Protect Plus

Productinfo

Name

• net-mail

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.21.0
• 1.21.1
• 1.21.2
• 1.21.3
• 1.21.4
• 1.21.5
• 1.21.6
• 1.21.7
• 1.22.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion