Lucene search

K
mageiaGentoo FoundationMGASA-2024-0217
HistoryJun 14, 2024 - 4:31 a.m.

Updated golang packages fix security vulnerabilities

2024-06-1404:31:37
Gentoo Foundation
advisories.mageia.org
8
golang
packages
security
vulnerabilities
archive/zip
handling
zip files
implementations
rejection
cve-2024-24789
is methods
ipv4-mapped ipv6 addresses
cve-2024-24790
unix

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.0%

The archive/zip package’s handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. (CVE-2024-24789) The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. (CVE-2024-24790)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchgolang< 1.21.11-1golang-1.21.11-1.mga9

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

6.3 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.0%