CVE-2024-24784: Comments in display names are incorrectly handled in net/mail

red hat product security vex CVE-2024-24784 updated 2026-11-05 cvss 5.4

golang: net/mail: comments in display names are incorrectly handled

Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel8
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Pipelines openshift-pipelines-client
affected: workaround, no fix available
Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
affected: workaround, no fix planned “Out of support scope”
Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat Ceph Storage 7 rhceph/grafana-rhel9
affected: workaround, no fix available
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-preflight
affected: workaround, no fix planned “Will not fix”
Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +12 more Red Hat Enterprise Linux 9 skopeo, grafana, skopeo-tests, grafana-selinux, osbuild-composer, osbuild-composer-core, +2 more
affected: workaround, no fix available, no fix planned “Will not fix”

show 23 more

Red Hat OpenShift Container Platform 4 openshift-golang-builder-container
affected: workaround, no fix available
Red Hat OpenShift Dev Spaces devspaces/traefik-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8
affected: workaround, no fix available
Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
affected: workaround, no fix planned “Will not fix”
Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-podvm-payload-rhel9 Red Hat OpenShift Virtualization 4 kubevirt Red Hat Quay 3 quay/quay-builder-rhel8
affected: workaround, no fix available
Red Hat Service Interconnect 1 skupper-cli
affected: workaround, no fix planned “Will not fix”
Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
affected: workaround, no fix planned “Out of support scope”
Red Hat KDO 5.0 for RHEL 9 kube-descheduler-operator/descheduler-rhel9 v5.0-31, kube-descheduler-operator/kube-descheduler-rhel9-operator v5.0-28, kube-descheduler-operator/kube-descheduler-operator-bundle v5.0-23
fixed: vendor fix RHSA-2024:3617
Red Hat Migration Toolkit for Virtualization 2.6 migration-toolkit-virtualization/mtv-api-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-rhel8-operator 2.6.2-11, migration-toolkit-virtualization/mtv-controller-rhel9 2.6.2-9, migration-toolkit-virtualization/mtv-operator-bundle 2.6.2-26, migration-toolkit-virtualization/mtv-validation-rhel9 2.6.2-9, +7 more
fixed: vendor fix RHBA-2024:3470
Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-plugin-rhel9 1.3.2-9
fixed: vendor fix RHSA-2024:3790
Red Hat OSSO 1.3 for RHEL 9 openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator v1.3-12, openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle v1.3-12
fixed: vendor fix RHSA-2024:3637
Red Hat Ceph Storage 8.1 Tools rhceph/rhceph-8-rhel9 8-492, rhceph/grafana-rhel9 11.5.2-6, rhceph/keepalived-rhel9 2.2.8-65, rhceph/oauth2-proxy-rhel9 v7.6.0-27, rhceph/snmp-notifier-rhel9 1.2.1-115, rhceph/rhceph-haproxy-rhel9 2.4.22-67, +1 more
fixed: vendor fix RHSA-2025:9776
Red Hat Enterprise Linux AppStream (v. 8) crit 3.18-5.module+el8.10.0+22202+761b9a65, crit 3.18-5.module+el8.10.0+22283+6d6d094a, criu 3.18-5.module+el8.10.0+22202+761b9a65, criu 3.18-5.module+el8.10.0+22283+6d6d094a, crun 1.14.3-2.module+el8.10.0+22202+761b9a65, crun 1.14.3-2.module+el8.10.0+22283+6d6d094a, +67 more
fixed: vendor fix RHSA-2024:5258
Red Hat Enterprise Linux AppStream (v. 9) golang 1.21.9-2.el9_4, go-toolset 1.21.9-2.el9_4, golang-bin 1.21.9-2.el9_4, golang-src 1.21.9-2.el9_4, golang-misc 1.21.9-2.el9_4, golang-tests 1.21.9-2.el9_4
fixed: vendor fix RHSA-2024:2562
Red Hat Migration Toolkit 1.7 rhmtc/openshift-migration-controller-rhel8 v1.7.16-4
fixed: vendor fix RHSA-2024:4520
Red Hat OpenShift Container Platform 4.16 podman 4.9.4-5.1.rhaos4.16.el8, podman 4.9.4-5.1.rhaos4.16.el9, podman-tests 4.9.4-5.1.rhaos4.16.el8, podman-tests 4.9.4-5.1.rhaos4.16.el9, podman-docker 4.9.4-5.1.rhaos4.16.el8, podman-docker 4.9.4-5.1.rhaos4.16.el9, +204 more
fixed: vendor fix RHSA-2024:0045
Red Hat OpenShift distributed tracing 3.2 rhosdt/tempo-rhel8 2.4.2-3, rhosdt/tempo-query-rhel8 0.10.0-8, rhosdt/jaeger-agent-rhel8 1.57.0-5, rhosdt/jaeger-query-rhel8 1.57.0-5, rhosdt/tempo-gateway-rhel8 1.0.0-8, rhosdt/tempo-rhel8-operator 0.10.0-6, +13 more
fixed: vendor fix RHSA-2024:3621
Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.12.0-7.el8
fixed: vendor fix RHSA-2024:4023
Red Hat OpenShift Serverless 1.33 openshift-serverless-1/client-kn-rhel8 1.12.0-4, openshift-serverless-1/func-utils-rhel8 1.33.0-4, openshift-serverless-1/serving-queue-rhel8 1.12.0-4, openshift-serverless-1/eventing-mtping-rhel8 1.12.0-6, openshift-serverless-1/kourier-control-rhel8 1.12.0-4, openshift-serverless-1/serving-webhook-rhel8 1.12.0-4, +30 more
fixed: vendor fix RHSA-2024:4028
Red Hat OpenStack Services on OpenShift rhoso-operators/sg-core-rhel9 1.0.4-4, rhoso-operators/ovn-rhel9-operator 1.0.4-4, rhoso-operators/heat-rhel9-operator 1.0.4-4, rhoso-operators/nova-rhel9-operator 1.0.4-4, rhoso-operators/test-rhel9-operator 1.0.4-4, rhoso-operators/infra-rhel9-operator 1.0.4-4, +19 more
fixed: vendor fix RHSA-2024:9485
Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.2-6, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.2-4, advanced-cluster-security/rhacs-scanner-rhel8 4.4.2-4, advanced-cluster-security/rhacs-rhel8-operator 4.4.2-4, advanced-cluster-security/rhacs-collector-rhel8 4.4.2-4, advanced-cluster-security/rhacs-operator-bundle 4.4.2-6, +7 more
fixed: vendor fix RHSA-2024:2941
Red Hat RODOO 1.1 for RHEL 9 run-once-duration-override-operator/run-once-duration-override-rhel9 v1.1-21, run-once-duration-override-operator/run-once-duration-override-rhel9-operator v1.1-21, run-once-duration-override-operator/run-once-duration-override-operator-bundle v1.1-20
fixed: vendor fix RHSA-2024:1616
Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.16 python-pyasn1 0.5.1-3.el9, python3-pyasn1 0.5.1-3.el9, pysnmp-lextudio 5.0.26-2.el9, python-eventlet 0.33.1-6.el9, python-gunicorn 20.0.4-4.el9, python3-eventlet 0.33.1-6.el9, +139 more Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9 Red Hat Logical Volume Manager Storage lvms4/lvms-rhel9-operator Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.2-9, oadp/oadp-rhel9-operator 1.3.2-9, oadp/oadp-operator-bundle 1.3.2-19, oadp/oadp-mustgather-rhel9 1.3.2-19, oadp/oadp-velero-plugin-for-aws-rhel9 1.3.2-9, oadp/oadp-velero-plugin-for-csi-rhel9 1.3.2-9, +4 more
not affected: vulnerable code not present

7 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

ecosystem	package	affected	fixed in
bitnami	golang	<1.21.8 >=1.22.0-0, <1.22.1	1.21.8 1.22.1
go	stdlib	<1.21.8 >=1.22.0-0, <1.22.1	1.21.8 1.22.1

Comments in display names are incorrectly handled in net/mail

Patch / fix

Vendor advisories

CISA SSVC

Exploit prediction

CVSS scores

Affected packages

Affected products

References

Sources

Summary