CVE-2024-24784
Assigner: Go
Published: 2024-03-05T22:22:32.186Z
State: PUBLISHED
title: Comments in display names are incorrectly handled in net/mail
descriptions: value: The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
affected: vendor: Go standard library
product: net/mail
collectionURL: https://pkg.go.dev
packageName: net/mail
versions: version: 0
lessThan: 1.21.8
status: affected
versionType: semver
version: 1.22.0-0
lessThan: 1.22.1
status: affected
versionType: semver
programRoutines: addrParser.consumeGroupList
addrParser.consumePhrase
isAtext
Address.String
AddressParser.Parse
AddressParser.ParseList
Header.AddressList
ParseAddress
ParseAddressList
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
credits: value: Juho Nurminen of Mattermost
value: Slonser (https://github.com/Slonser)