Lucene search

GoCVE-2024-24789

HistoryJun 05, 2024 - 4:15 p.m.

CVE-2024-24789

2024-06-0516:15:10

web.nvd.nist.gov

cve-2024-24789

zip files

invalid handling

exploitation

rejection

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.9%

JSON

The archive/zip package’s handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Affected configurations

Nvd

Node

golanggoRange<1.21.11

golanggoRange1.22.0–1.22.4

VendorProductVersionCPE
golanggo*cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
golang	go	*	cpe:2.3:a:golang:go::::::::

CNA Affected

[
  {
    "vendor": "Go standard library",
    "product": "archive/zip",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "archive/zip",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.21.11",
        "status": "affected",
        "versionType": "semver"
      },
      {
        "version": "1.22.0-0",
        "lessThan": "1.22.4",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "findSignatureInBlock"
      },
      {
        "name": "NewReader"
      },
      {
        "name": "OpenReader"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.openwall.com/lists/oss-security/2024/06/04/1

go.dev/cl/585397

go.dev/issue/66869

groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ

lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/

pkg.go.dev/vuln/GO-2024-2888

Social References

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.9%

JSON

Related for CVE-2024-24789