Red Hat Security Advisory: golang security update
Red Hat has issued a moderate severity security advisory for the golang packages in Red Hat Enterprise Linux 9. The update addresses two vulnerabilities: CVE-2024-24789, involving incorrect handling of certain ZIP files in the archive/zip package, and CVE-2024-24790, concerning unexpected behavior in the net/netip package's Is methods for IPv4-mapped IPv6 addresses. These issues affect the Go programming language compiler and related tooling. The advisory provides updated packages to remediate these vulnerabilities.
AI Analysis
Technical Summary
This advisory covers two security fixes in the golang packages provided by Red Hat Enterprise Linux 9. The first vulnerability (CVE-2024-24789) relates to improper handling of certain ZIP files in the archive/zip package, potentially leading to unexpected behavior or errors when processing ZIP archives. The second vulnerability (CVE-2024-24790) involves unexpected behavior in the Is methods of the net/netip package when handling IPv4-mapped IPv6 addresses, which could cause incorrect IP address evaluations. Both issues have been rated with moderate security impact by Red Hat Product Security. The advisory includes updated golang packages to address these flaws.
Potential Impact
The vulnerabilities could cause incorrect processing of ZIP files and erroneous behavior in IP address handling within applications using the affected golang packages. While the exact impact details and exploitation scenarios are not provided, Red Hat rates these issues as having moderate security impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated golang packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2024:4212 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as fixed by the vendor. No additional mitigation steps are indicated.
Red Hat Security Advisory: golang security update
Description
Red Hat has issued a moderate severity security advisory for the golang packages in Red Hat Enterprise Linux 9. The update addresses two vulnerabilities: CVE-2024-24789, involving incorrect handling of certain ZIP files in the archive/zip package, and CVE-2024-24790, concerning unexpected behavior in the net/netip package's Is methods for IPv4-mapped IPv6 addresses. These issues affect the Go programming language compiler and related tooling. The advisory provides updated packages to remediate these vulnerabilities.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers two security fixes in the golang packages provided by Red Hat Enterprise Linux 9. The first vulnerability (CVE-2024-24789) relates to improper handling of certain ZIP files in the archive/zip package, potentially leading to unexpected behavior or errors when processing ZIP archives. The second vulnerability (CVE-2024-24790) involves unexpected behavior in the Is methods of the net/netip package when handling IPv4-mapped IPv6 addresses, which could cause incorrect IP address evaluations. Both issues have been rated with moderate security impact by Red Hat Product Security. The advisory includes updated golang packages to address these flaws.
Potential Impact
The vulnerabilities could cause incorrect processing of ZIP files and erroneous behavior in IP address handling within applications using the affected golang packages. While the exact impact details and exploitation scenarios are not provided, Red Hat rates these issues as having moderate security impact. There are no known exploits in the wild at this time.
Mitigation Recommendations
Red Hat has released updated golang packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the provided updates as detailed in the Red Hat advisory RHSA-2024:4212 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as fixed by the vendor. No additional mitigation steps are indicated.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2024:4212
- Cve Count
- 2
- Additional Cves
- ["CVE-2024-24790"]
- Cvss Version
- null
Threat ID: 6a1df669e29bf47b50462118
Added to database: 6/1/2026, 9:15:21 PM
Last enriched: 6/1/2026, 9:23:30 PM
Last updated: 6/2/2026, 5:09:09 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.