Improper Input Validation

🗓️ 10 Jun 2024 06:03:06Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 19 Views

github.com/golang/go/ is vulnerable to Improper Input Validation due to misalignment in zip implementation

Reporter	Title	Published	Views	Family All 993
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security restrictions bypass in Golang Go [CVE-2024-24789]	30 Jan 202521:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph contains vulnerabilities found in Golang (CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2024-24788 CVE-2024-24789 CVE-2024-24790 CVE-2024-6104 CVE-2024-24791 CVE-2024-34155 CVE-2024-34156)	7 Jul 202520:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Oct 2024	14 Oct 202416:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	25 Sep 202413:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Golang Affect IBM Cloud Pak System	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security restrictions bypass in Golang Go [CVE-2024-24789]	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	5 Jun 202506:12	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in archive/zip affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	28 Mar 202515:53	–	ibm

Vulners

Node

golang goMatch1.22.3-r0go

AND

golang goMatch1.22.2-r0go

AND

alpinelinux alpine_linuxMatch3.20

golang goMatch1.18.5-r0go

AND

golang goMatch1.21.4-r0go

AND

golang goMatch1.20.6-r0go

AND

golang goMatch1.20.2-r1go

AND

golang goMatch1.19.1-r0go

AND

golang goMatch1.20.2-r0go

AND

golang goMatch1.19.5-r0go

AND

golang goMatch1.18-r0go

AND

golang goMatch1.18.2-r0go

AND

golang goMatch1.18.1-r1go

AND

golang goMatch1.19.3-r0go

AND

golang goMatch1.22.0-r1go

AND

golang goMatch1.20.4-r0go

AND

golang goMatch1.19-r0go

AND

golang goMatch1.18.3-r0go

AND

golang goMatch1.18-r1go

AND

golang goMatch1.17.1-r0go

AND

golang goMatch1.17.8-r0go

AND

golang goMatch1.17.3-r0go

AND

golang goMatch1.13.10-r0go

AND

golang goMatch1.17.2-r0go

AND

golang goMatch1.20-r0go

AND

golang goMatch1.21.2-r0go

AND

golang goMatch1.20.1-r0go

AND

golang goMatch1.20.3-r0go

AND

golang goMatch1.21.5-r0go

AND

golang goMatch1.14.3-r0go

AND

golang goMatch1.22.2-r0go

AND

golang goMatch1.16.2-r0go

AND

golang goMatch1.22.1-r2go

AND

golang goMatch1.22.1-r1go

AND

golang goMatch1.16-r0go

AND

golang goMatch1.17.7-r0go

AND

golang goMatch1.20.7-r0go

AND

golang goMatch1.17.6-r0go

AND

golang goMatch1.17.4-r0go

AND

golang goMatch1.21.0-r0go

AND

golang goMatch1.21.1-r0go

AND

golang goMatch1.16.7-r0go

AND

golang goMatch1.22.3-r0go

AND

golang goMatch1.22.0-r0go

AND

golang goMatch1.19.4-r0go

AND

golang goMatch1.19.2-r0go

AND

golang goMatch1.16.3-r0go

AND

golang goMatch1.16.4-r0go

AND

golang goMatch1.19.1-r1go

AND

golang goMatch1.21.3-r1go

AND

golang goMatch1.13.8-r0go

AND

golang goMatch1.21.0-r1go

AND

golang goMatch1.22.1-r0go

AND

golang goMatch1.20.5-r2go

AND

golang goMatch1.16.5-r0go

AND

golang goMatch1.18.4-r2go

AND

golang goMatch1.18.3-r1go

AND

golang goMatch1.21.6-r0go

AND

alpinelinux alpine_linuxMatchedge

forgejo forgejoMatch1.20.4.0-r0go

AND

forgejo forgejoMatch1.20.1.0-r0go

AND

forgejo forgejoMatch1.21.1.0-r0go

AND

forgejo forgejoMatch1.21.6.0-r0go

AND

forgejo forgejoMatch1.19.3.0-r1go

AND

forgejo forgejoMatch7.0.2-r0go

AND

forgejo forgejoMatch1.21.7.0-r2go

AND

forgejo forgejoMatch1.20.3.0-r0go

AND

forgejo forgejoMatch1.20.4.1-r0go

AND

forgejo forgejoMatch1.20.5.0-r0go

AND

forgejo forgejoMatch7.0.3-r0go

AND

forgejo forgejoMatch1.19.4.0-r0go

AND

forgejo forgejoMatch1.19.4.0-r2go

AND

forgejo forgejoMatch1.21.7.0-r0go

AND

forgejo forgejoMatch1.20.5.0-r1go

AND

forgejo forgejoMatch7.0.2-r1go

AND

forgejo forgejoMatch1.21.11.1-r0go

AND

forgejo forgejoMatch1.20.2.0-r0go

AND

forgejo forgejoMatch1.21.7.0-r1go

AND

forgejo forgejoMatch1.21.5.0-r0go

AND

forgejo forgejoMatch1.19.3.0-r0go

AND

alpinelinux alpine_linuxMatchedge

golang github.com/golang/goRangego1–go1.21.10go

golang github.com/golang/goRangego1.22rc1–go1.22.3go

Source	Link
github	www.github.com/golang/go/commit/cf501ac0c5fe351a8582d20b43562027927906e7
pkg	www.pkg.go.dev/vuln/GO-2024-2888
go	www.go.dev/cl/585397
go	www.go.dev/issue/66869
groups	www.groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
security	www.security.netapp.com/advisory/ntap-20250131-0008/
openwall	www.openwall.com/lists/oss-security/2024/06/04/1

31 Jan 2025 17:23Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.5

EPSS0.00007

SSVC