CVE-2021-39293
CVE-2021-39293
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
CVSS 7.5 · High · EPSS 6.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
golang-1.15 Debian:11
- Versions
- 1.15.9-6
- Affected ranges
- ECOSYSTEM: < 1.15.15-1~deb11u1
Update to 1.15.15-1~deb11u1
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published