VDB
GHSA-49gw-vxvf-fc2g
GHSA-49gw-vxvf-fc2g
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Record from GitHub Advisory Database · Published June 5, 2024
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| nri-cassandra | Chainguard | 2.13.6-r1 |
| cilium-1.14 | Chainguard | 1.14.11-r1 |
| cosign | Chainguard | 2.2.4-r5 |
| cloudflared | Chainguard | 2024.1.0-r11 |
| kubernetes-csi-external-resizer-1.9 | Chainguard | 1.9.4-r4 |
| newrelic-infrastructure-agent | Wolfi | 1.52.3-r1 |
| cluster-autoscaler-1.26 | Wolfi | 1.26.8-r4 |
| flux-image-reflector-controller | Wolfi | 0.32.0-r2 |
| prometheus-node-exporter-1.5 | Chainguard | 1.5.0-r12 |
| restic | Chainguard | 0.16.4-r10 |
| harbor-registry | Chainguard | 3.0.0_alpha1-r4 |
| certificate-transparency | Chainguard | 1.2.1-r1 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | nri-cassandra | 0 |
| chainguard | cilium-1.14 | 0 |
| chainguard | cosign | 0 |
| chainguard | cloudflared | 0 |
| chainguard | kubernetes-csi-external-resizer-1.9 | 0 |
| wolfi | newrelic-infrastructure-agent | 0 |
| wolfi | cluster-autoscaler-1.26 | 0 |
| wolfi | flux-image-reflector-controller | 0 |
| chainguard | prometheus-node-exporter-1.5 | 0 |
| chainguard | restic | 0 |
| chainguard | harbor-registry | 0 |
| chainguard | certificate-transparency | 0 |
| chainguard | local-path-provisioner | 0 |
| wolfi | k8ssandra-operator | 0 |
| chainguard | nri-nginx | 0 |
| chainguard | argo-cd-fips-2.10 | 0 |
| chainguard | timestamp-authority-fips | 0 |
| chainguard | gosu-1.11 | 0 |
| wolfi | opentofu | 0 |
| chainguard | aws-flb-kinesis-fips | 0 |
…and 1083 more
Timeline
- Jun 5, 2024 CVE Published
- Apr 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-49gw-vxvf-fc2g
vulnetix vdb fixes GHSA-49gw-vxvf-fc2gOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-49gw-vxvf-fc2g/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart