Use of Weak Hash Affecting github.com/google/gvisor/pkg/tcpip/transport/icmp package, versions <20231204.0.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-GOLANG-GITHUBCOMGOOGLEGVISORPKGTCPIPTRANSPORTICMP-8679642
- published31 Jan 2025
- disclosed31 Jan 2025
- creditInon Kaplan, Ron Even, Amit Klein
Introduced: 31 Jan 2025
NewCVE-2024-10026 Â (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade github.com/google/gvisor/pkg/tcpip/transport/icmp to version 20231204.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Use of Weak Hash and small seed sizes. An attacker can calculate a local IP address and a per-boot identifier, which could be used to track a device under certain conditions.