CVE-2024-24784

La función ParseAddressList controla incorrectamente los comentarios (texto entre paréntesis) dentro de los nombres para mostrar. Dado que se trata de una desalineación con los analizadores de direcciones conformes, puede dar lugar a que los programas que utilizan diferentes analizadores tomen diferentes decisiones de confianza.

A flaw was found in Go's net/mail standard library package. The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions made by programs using different parsers.

This update for go1.21-openssl fixes the following issues. Fixed denial of service due to improper 100-continue handling. Fixed mishandling of corrupt central directory record in archive/zip. Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip. Fixed arbitrary code execution during build on darwin in cmd/go. Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2. Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar. Fixed memory exhaustion in Request.ParseMultipartForm in net/http. Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509. Fixed comments in display names are incorrectly handled in net/mail. Fixed errors returned from MarshalJSON methods may break template escaping in html/template.