CVE-2024-45341: Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Deferred

AliasesUBUNTU-CVE-2024-45341DEBIAN-CVE-2024-45341CGA-226j-2x3m-fcvj+1723 more

Published 28-01-2025Last modified 21-02-2025

Vulnerability summary

CVE-2024-45341 is a medium (CVSS 6.1) vulnerability in go standard library crypto/x509. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.57%

0%100%

Low · +0.09 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 19 · Related 404

MGASA-2025-0021 OPENSUSE-SU-2025:14693-1 OPENSUSE-SU-2025:14694-1 OPENSUSE-SU-2025:14695-1 OPENSUSE-SU-2025:14710-1 OPENSUSE-SU-2025:15030-1+94 more

Showing 100 of 409.

Timeline

28-01-2025
PublishedVulnerability first disclosed.
21-02-2025
Last modifiedVulnerability information updated.

Description

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

CVSS metrics

5 scores · 5 sources · 1 version

v3.16.1

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

Increase +0.09 pp

From 0.48% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r22
actions-runner-controller< 0.10.1-r2
actions-runner-controller-fips< 0.10.1-r2
age< 1.2.1-r1
age-fips< 1.2.1-r1

amazon-cloudwatch-agent-fips< 1.300052.0-r0
amazon-k8s-cni< 1.19.2-r1
amazon-k8s-cni-fips< 1.19.2-r2
amazon-k8s-cni-init-fips< 1.19.2-r2
amazon-k8s-cni-init-fips-compat< 1.19.2-r2
ansible-operator< 1.37.1-r1
apache-beam-java-sdk< 2.62.0-r0
apache-beam-python-3.11-sdk< 2.62.0-r0
argo-events< 1.9.5-r1
argo-events-fips< 1.9.5-r1
argo-rollouts< 1.7.2-r4
argo-workflows< 3.6.3-r1
argo-workflows-fips< 3.6.2-r4
atlantis< 0.32.0-r1
atlantis-fips< 0.32.0-r1
authservice-fips< 1.0.4-r0
aws-application-networking-k8s< 1.1.0-r2
aws-ebs-csi-driver< 1.52.1-r0
aws-efs-csi-driver< 2.1.4-r1
aws-efs-csi-driver-fips< 2.1.4-r1
aws-flb-cloudwatch< 1.9.4-r14
aws-flb-cloudwatch-compat-fips< 1.9.4-r7
aws-flb-cloudwatch-fips< 1.9.4-r7
aws-flb-firehose< 1.7.2-r14
aws-flb-firehose-fips< 1.7.2-r7
aws-flb-kinesis< 1.10.2-r15
aws-flb-kinesis-fips< 1.10.2-r8
aws-load-balancer-controller< 2.11.0-r2
aws-load-balancer-controller-fips< 2.12.0-r1
aws-network-policy-agent< 1.1.6-r1
aws-network-policy-agent-fips< 1.1.6-r1
aws-privateca-issuer< 1.4.0-r3
aws-privateca-issuer-fips< 1.4.0-r3
aws-signer-notation-plugin< 1.0.350-r1
aws-signer-notation-plugin-fips< 1.0.350-r1
azure-aad-pod-identity-mic< 1.8.17-r16
azuredisk-csi-1.28< 1.28.11-r6
azuredisk-csi-1.29< 1.29.12-r1
azuredisk-csi-1.30< 1.30.7-r1
azuredisk-csi-1.31< 1.31.2-r1
azuredisk-csi-fips-1.28< 1.28.11-r5
azuredisk-csi-fips-1.29< 1.29.12-r1
azuredisk-csi-fips-1.30< 1.30.7-r1
azuredisk-csi-fips-1.31< 1.31.2-r1
bank-vaults< 1.20.4-r23
bank-vaults-fips< 1.20.4-r19
bazelisk< 1.25.0-r1
beats-7< 7.17.27-r1
beats-fips-7< 7.17.27-r1
bom< 0.6.0-r15
boring-registry< 0.15.5-r1
boring-registry-fips< 0.15.5-r1
buildkitd-fips< 0.19.0-r0
cadvisor< 0.51.0-r3
cadvisor-fips< 0.50.0-r4
calico-3.29< 3.29.1-r4
calico-fips-3.29< 3.29.1-r5
capslock< 0.2.7-r1
cass-operator< 1.23.0-r2
cass-operator-fips< 1.23.0-r2
cass-operator-fips-no-pvc-delete< 1.23.0-r2
cert-manager-cmctl< 2.1.1-r4
cert-manager-cmctl-fips< 2.1.1-r4
cert-manager-webhook-pdns< 2.5.1-r10
cert-manager-webhook-pdns-fips< 2.5.1-r12
certificate-transparency< 1.3.1-r1
certificate-transparency-fips< 1.3.1-r1
cfssl< 1.6.5-r14
cfssl-fips< 1.6.5-r6
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r10
chartmuseum-fips< 0.16.2-r8
checksec< 3.0.0-r1
cilium-1.15< 1.15.13-r0
cilium-1.15-clustermesh-apiserver< 1.15.13-r0
cilium-1.15-container-init< 1.15.13-r0
cilium-1.15-container-init-compat< 1.15.13-r0
cilium-1.15-hubble-relay< 1.15.13-r0
cilium-1.15-iptables< 1.15.13-r0
cilium-1.15-operator-aws< 1.15.13-r0
cilium-1.15-operator-generic< 1.15.13-r0
cilium-envoy-fips-1.15< 1.15.13-r0
cilium-envoy-fips-1.16< 1.16.6-r0
cilium-fips-1.15< 1.15.13-r0
cilium-fips-1.16< 1.16.6-r0
cloud-provider-aws-1.28< 1.28.10-r3
cloud-provider-aws-1.29< 1.29.7-r3
cloud-provider-aws-1.30< 1.30.6-r3
cloud-provider-aws-1.31< 1.31.4-r3
cloud-provider-aws-1.32< 1.32.0-r3
cloud-provider-aws-fips-1.28< 1.28.10-r3
cloud-provider-aws-fips-1.29< 1.29.7-r3
cloud-provider-aws-fips-1.30< 1.30.6-r3
cloud-provider-aws-fips-1.31< 1.31.4-r3
cloud-provider-aws-fips-1.32< 1.32.0-r3
cloud-provider-azure-1.27< 1.27.21-r3
cloud-provider-azure-1.28< 1.28.13-r3
cloud-provider-azure-1.29< 1.29.11-r3
cloud-provider-azure-1.30< 1.30.7-r3
cloud-provider-azure-1.31< 1.31.1-r4
cloud-provider-azure-1.32< 1.32.0-r1
cloud-provider-azure-cloud-controller-manager-1.31< 1.31.1-r4
cloud-provider-azure-cloud-controller-manager-1.31-compat< 1.31.1-r4
cloud-provider-azure-cloud-node-manager-1.31< 1.31.1-r4
cloud-provider-azure-cloud-node-manager-1.31-compat< 1.31.1-r4
cloud-provider-azure-fips-1.27< 1.27.21-r3
cloud-provider-azure-fips-1.28< 1.28.13-r3
cloud-provider-azure-fips-1.29< 1.29.11-r3
cloud-provider-azure-fips-1.30< 1.30.7-r3
cloud-provider-azure-fips-1.31< 1.31.1-r3
cloud-provider-azure-fips-1.32< 1.32.0-r1
cloudnative-pg< 1.25.0-r1
cloudnative-pg-fips< 1.25.0-r1
cloudprober-fips< 0.13.9-r0
cluster-autoscaler-1.31< 1.31.1-r5
cluster-autoscaler-1.31-compat< 1.31.1-r5
cluster-autoscaler-1.32< 1.32.0-r2
cluster-autoscaler-fips-1.31< 1.31.1-r3
cluster-autoscaler-fips-1.32< 1.32.0-r2
cni-plugins< 1.6.2-r1
cni-plugins-fips< 1.6.2-r1
configmap-reload< 0.14.0-r2
configmap-reload-fips< 0.14.0-r1
configmap-reload-fips-0.11< 0.11.1-r13
configmap-reload-fips-0.12< 0.12.0-r12
confluent-common-docker< 7.6.0-r10
conftest< 0.56.0-r3
conftest-fips< 0.56.0-r3
consul-1.18< 1.18.2-r6
consul-1.19< 1.19.2-r5
consul-1.20< 1.20.2-r1
consul-fips-1.19< 1.19.2-r5
consul-fips-1.20< 1.20.2-r1
consul-k8s-1.1< 1.1.18-r1
consul-k8s-1.3< 1.3.9-r3
consul-k8s-1.4< 1.4.8-r1
consul-k8s-1.5< 1.5.5-r1
consul-k8s-1.6< 1.6.2-r1
consul-k8s-fips-1.1< 1.1.18-r1
consul-k8s-fips-1.3< 1.3.9-r3
consul-k8s-fips-1.4< 1.4.8-r1
consul-k8s-fips-1.5< 1.5.5-r1
consul-k8s-fips-1.6< 1.6.2-r1
containerd-1< 1.7.25-r1
containerd-2< 2.0.2-r1
containerd-fips< 2.0.2-r1
containerd-service-fips< 2.0.2-r1
containerd-shim-runc-v2-fips< 2.0.2-r1
containerd-stress-fips< 2.0.2-r1
controller-gen< 0.17.1-r1
cortex< 1.18.1-r4
cortex-fips< 1.18.1-r4
cosign< 2.4.1-r5
cosign-fips< 2.4.1-r4
crane< 0.20.3-r1
cri-tools< 1.32.0-r3
croc< 10.2.1-r1
crossplane-provider-aws< 1.19.0-r1
crossplane-provider-azure< 1.11.0-r1
crossplane-provider-keycloak< 1.7.0-r4
crossplane-provider-keycloak-fips< 1.7.0-r3
crossplane-provider-sql< 0.11.0-r1
crossplane-provider-sql-fips< 0.11.0-r1
ctop< 0.7.7-r21
ctr-fips< 2.0.2-r1
dagdotdev< 0.0.12-r2
dask-gateway< 2024.1.0-r14
dataplaneapi< 3.0.4-r1
dataplaneapi-fips< 3.0.4-r1
delve< 1.24.0-r1
descheduler< 0.32.1-r1
dex< 2.41.1-r4
dex-fips< 2.41.1-r4
dex-k8s-authenticator< 1.4.0-r15
direnv< 2.35.0-r1
distribution< 3.0.0-r5
distribution-fips< 3.0.0-r4
dive< 0.12.0-r14
docker-cli-fips< 27.5.1-r0
docker-compose< 2.32.4-r1
docker-compose-fips< 2.32.4-r1
docker-credential-acr-env< 0.7.0-r17
docker-credential-acr-env-fips< 0.7.0-r2
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.9.0-r3
docker-credential-ecr-login-fips< 0.9.0-r1
docker-credential-gcr< 2.1.26-r2
docker-credential-gcr-fips< 2.1.26-r1
docker-fips< 27.5.1-r0
dockerize< 0.9.2-r1
dockerize-fips< 0.9.2-r1
eck-operator< 2.16.1-r0
eck-operator-fips< 2.16.1-r0
elvish< 0.21.0-r1

Show all 199

Alpine1 product

go< 1.23.5-r0

2 vendors · 200 products · Showing 200 of 1270

References

13 links

Show all 13 references

security-tracker.debian.org/tracker/CVE-2024-45341Advisory
nvd.nist.gov/vuln/detail/CVE-2024-45341OvalAdvisory
security.alpinelinux.org/vuln/CVE-2024-45341Advisory