GHSA-xgch-x3mx-cm3c
safeurl is Missing IPv6 CIDR Ranges in Blocklist
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/doyensec/safeurl | < 0.2.4 | 0.2.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The `privateNetworks` blocklist was found to be missing newly added CIDR ranges. More specifically, the following CIDR ranges were not being blocked:
- `64:ff9b:1::/48`: NAT64 local-use prefix (RFC 8215)
- `5f00::/16`: Segment Routing (SRv6) SIDs (RFC 9602)
- `3fff::/20`: documentation prefix (RFC 9637)
- `100:0:0:1::/64`: Dummy IPv6 Prefix (RFC 9780)
### Impact
If exploited, an attacker would potentially be able to reach resources hosted on the IPs residing in the missing ranges.
### Workarounds
Disable IPv6 by setting `EnableIPv6(false)`. This is the default behavior of the library.
### Resolution
Upgrade to v0.2.4
### Credits
safeurl thanks @tonghuaroot for reporting.
References
External links from the advisory. They lead to third-party sites.