id: GO-2024-2609
modules:
    - module: std
      versions:
        - fixed: 1.21.8
        - introduced: 1.22.0-0
          fixed: 1.22.1
      vulnerable_at: 1.22.0
      packages:
        - package: net/mail
          symbols:
            - addrParser.consumeGroupList
            - addrParser.consumePhrase
            - isAtext
          derived_symbols:
            - Address.String
            - AddressParser.Parse
            - AddressParser.ParseList
            - Header.AddressList
            - ParseAddress
            - ParseAddressList
summary: Comments in display names are incorrectly handled in net/mail
description: |-
    The ParseAddressList function incorrectly handles comments (text within
    parentheses) within display names. Since this is a misalignment with conforming
    address parsers, it can result in different trust decisions being made by
    programs using different parsers.
credits:
    - Juho Nurminen of Mattermost
    - Slonser (https://github.com/Slonser)
references:
    - report: https://go.dev/issue/65083
    - fix: https://go.dev/cl/555596
    - web: https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
cve_metadata:
    id: CVE-2024-24784
    cwe: 'CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences'
    references:
        - https://security.netapp.com/advisory/ntap-20240329-0007/
        - http://www.openwall.com/lists/oss-security/2024/03/08/4