CVE-2024-45341: PKI Certificate Information Disclosure

CVE-2024-45341 Overview

CVE-2024-45341 is a certificate validation bypass vulnerability in the Go programming language's certificate handling functionality. A certificate with a URI containing an IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. This flaw allows certificates to pass validation when they should be rejected based on the configured name constraints.

Critical Impact

Private PKI implementations using URI-based name constraints may accept certificates that should be rejected, potentially allowing unauthorized entities to present certificates that bypass intended access controls.

Affected Products

• Go programming language (crypto/x509 package)
• Applications built with Go that utilize private PKI with URI name constraints
• NetApp products utilizing affected Go versions

Discovery Timeline

• January 28, 2025 - CVE-2024-45341 published to NVD
• February 21, 2025 - Last updated in NVD database

Technical Details for CVE-2024-45341

Vulnerability Analysis

This vulnerability exists in Go's certificate validation logic, specifically in how URI name constraints are processed when the URI contains an IPv6 address with a zone identifier. In IPv6 addressing, a zone ID (also known as a scope ID) is appended to link-local addresses using the % character to specify the network interface. When parsing and validating certificates against name constraints, the Go crypto/x509 package fails to properly handle this zone ID component, leading to incorrect constraint matching.

The issue is limited in scope to private PKI deployments that utilize URI-based name constraints. Certificates containing URIs are not permitted in the web PKI (public certificate authorities), which means this vulnerability does not affect standard HTTPS/TLS connections to public websites. However, organizations running private certificate infrastructures that leverage URI constraints for access control or service identification may be impacted.

Root Cause

The root cause lies in the parsing logic within Go's crypto/x509 package when evaluating URI name constraints. The zone ID portion of an IPv6 address in a URI is not properly normalized or stripped during the constraint matching process. This causes the validation routine to incorrectly determine that a certificate satisfies a URI name constraint when the zone ID creates an unintended match or allows the constraint check to be bypassed entirely.

Attack Vector

An attacker could exploit this vulnerability by crafting a certificate with a URI containing an IPv6 address with a specially crafted zone ID. When this certificate is presented to a Go application that validates certificates against URI name constraints, the malformed URI may incorrectly pass validation. This requires network access and user interaction to present the malicious certificate.

The attack scenario involves:

1. An attacker obtains or generates a certificate with a URI containing an IPv6 address with a zone ID
2. The certificate is presented during a TLS handshake or certificate validation process
3. The Go application's name constraint validation incorrectly accepts the certificate
4. The attacker gains unauthorized access or impersonates a legitimate service within the private PKI

For detailed technical information about the vulnerability mechanism and the fix, refer to the Go.dev Issue #71156 and Go.dev GoCL #643099.

Detection Methods for CVE-2024-45341

Indicators of Compromise

• Certificates containing URIs with IPv6 addresses and zone IDs (e.g., uri://[fe80::1%25eth0]/resource)
• Unexpected certificate validation successes in application logs where URI name constraints should have rejected certificates
• Authentication or authorization events from previously unknown or unauthorized certificate subjects

Detection Strategies

• Review application logs for certificate validation events involving URI-based certificates with IPv6 addresses
• Implement certificate transparency monitoring for your private PKI to detect anomalous certificate issuance
• Audit existing certificates in your private PKI for URIs containing IPv6 zone IDs
• Use Go's vulnerability database tooling (govulncheck) to identify affected applications in your codebase

Monitoring Recommendations

• Enable verbose logging for certificate validation in Go applications using private PKI
• Monitor for authentication events from certificate subjects that should be constrained by URI name constraints
• Set up alerts for certificate validation patterns involving IPv6 addresses in URIs
• Regularly scan deployed Go binaries for vulnerable versions using software composition analysis tools

How to Mitigate CVE-2024-45341

Immediate Actions Required

• Update Go to a patched version as indicated in the Go.dev Vulnerability Report GO-2025-3373
• Rebuild and redeploy all Go applications that handle certificate validation with URI name constraints
• Audit private PKI certificates for any containing URIs with IPv6 zone IDs
• Review recent certificate validation logs for signs of exploitation

Patch Information

The Go team has released patches addressing this vulnerability. Detailed patch information is available in the Go.dev GoCL #643099. Organizations should update to the latest patched Go version and rebuild affected applications. NetApp has also issued guidance in their Security Advisory NTAP-20250221-0004.

Workarounds

• Avoid using URI-based name constraints in private PKI configurations until systems can be patched
• Implement additional certificate validation logic at the application layer to reject certificates with IPv6 zone IDs in URIs
• Consider switching to alternative constraint types (such as DNS name constraints) that are not affected by this vulnerability
• Restrict certificate issuance in your private CA to prevent certificates containing URIs with IPv6 addresses

# Check Go version and scan for vulnerability
go version
govulncheck ./...

# Rebuild applications after updating Go
go build -o myapp ./cmd/myapp