CVE-2024-45341
Published: January 23, 2025Last modified: August 31, 2026
Description
A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.1 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | REQUIRED |
| Scope | CHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | go | Fixed (1.21.12-r3) |
| 25 LTS | go | Not affected (1.24.3-r0) | |
| Stream | go | Fixed (1.23.5-r0) | |
| Hardened Containers | 23 LTS | go | Fixed (1.21.12-r3) |
| 25 LTS | go | Not affected (1.24.3-r0) | |
| Stream | go | Fixed (1.23.5-r0) |