Improper Input Validation

2024-06-1006:03:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

improper input validation

vulnerability

zip implementations

github.com/golang/go/

software

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.9%

JSON

github.com/golang/go/ is vulnerable to Improper Input Validation. The vulnerability is due to a misalignment in the behavior of zip implementations, which can be exploited to create zip files with varying contents based on the implementation reading the file.

CPENameOperatorVersion
github.com/golang/golego1.22.3
github.com/golang/golego1.21.10
github.com/golang/golego1.22.3
github.com/golang/golego1.21.10
go:3.20eq1.22.3-r0
go:3.20eq1.22.2-r0
go:edgeeq1.16-r0
go:edgeeq1.18.2-r0
go:edgeeq1.13.10-r0
go:edgeeq1.16.7-r0

Name	Operator	Version
github.com/golang/go	le	go1.22.3
github.com/golang/go	le	go1.21.10
github.com/golang/go	le	go1.22.3
github.com/golang/go	le	go1.21.10
go:3.20	eq	1.22.3-r0
go:3.20	eq	1.22.2-r0
go:edge	eq	1.16-r0
go:edge	eq	1.18.2-r0
go:edge	eq	1.13.10-r0
go:edge	eq	1.16.7-r0