CVE-2024-45341

Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509

Description

A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.

6.1

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.03%

Affected: Go standard library crypto/x509

References

Link	Tags
https://go.dev/cl/643099
https://go.dev/issue/71156
https://groups.google.com/g/golang-dev/c/bG8cv1muIBM/m/G461hA6lCgAJ
https://groups.google.com/g/golang-dev/c/CAWXhan3Jww/m/bk9LAa-lCgAJ
https://pkg.go.dev/vuln/GO-2025-3373
https://security.netapp.com/advisory/ntap-20250221-0004/

Frequently Asked Questions

What is the severity of CVE-2024-45341?: CVE-2024-45341 has been scored as a medium severity vulnerability.
How to fix CVE-2024-45341?: To fix CVE-2024-45341, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-45341 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-45341 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-45341?: CVE-2024-45341 affects Go standard library crypto/x509.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.