CVE-2024-24789
CVE-2024-24789 · Mishandling of corrupt central directory record in archive/zip
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
archive/zip
- Versions
- ≥ 0, < 1.21.11: Affected (semver)
- ≥ 1.22.0-0, < 1.22.4: Affected (semver)
Update to 1.21.11; Update to 1.22.4
golang-1.19 Debian:12
- Versions
- 1.19.10-1
- 1.19.10-2
- 1.19.11-1
- 1.19.12-1
- 1.19.12-2
- 1.19.12-2~bpo11+1
- 1.19.12-2~bpo12+1
- 1.19.13-1
- 1.19.13-1~bpo11+1
- 1.19.13-1~bpo12+1
- 1.19.8-2
- 1.19.9-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:16.04:LTS
- Versions
- 1.18.1-1ubuntu1~16.04.6
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~16.04.6+esm1
Update to 1.18.1-1ubuntu1~16.04.6+esm1
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:16.04:LTS
- Versions
- 1.13.8-1ubuntu1~16.04.2
- 1.13.8-1ubuntu1~16.04.3
- 1.13.8-1ubuntu1~16.04.3+esm2
- 1.13.8-1ubuntu1~16.04.3+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.13 Ubuntu:Pro:18.04:LTS
- Versions
- 1.13.8-1ubuntu1~18.04.2
- 1.13.8-1ubuntu1~18.04.3
- 1.13.8-1ubuntu1~18.04.4
- 1.13.8-1ubuntu1~18.04.4+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:18.04:LTS
- Versions
- 1.16.2-0ubuntu1~18.04.2
- 1.16.2-0ubuntu1~18.04.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.18 Ubuntu:Pro:18.04:LTS
- Versions
- 1.18.1-1ubuntu1~18.04.3
- 1.18.1-1ubuntu1~18.04.4
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~18.04.4+esm1
Update to 1.18.1-1ubuntu1~18.04.4+esm1
golang-1.18 Ubuntu:20.04:LTS
- Versions
- 1.18.1-1ubuntu1~20.04.1
- 1.18.1-1ubuntu1~20.04.2
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1~20.04.3
Update to 1.18.1-1ubuntu1~20.04.3
golang-1.21 Ubuntu:20.04:LTS
- Versions
- 1.21.1-1~ubuntu20.04.1
- 1.21.1-1~ubuntu20.04.2
- Affected ranges
- ECOSYSTEM: < 1.21.1-1~ubuntu20.04.3
Update to 1.21.1-1~ubuntu20.04.3
golang-1.22 Ubuntu:20.04:LTS
- Affected ranges
- ECOSYSTEM: < 1.22.2-2~20.04.1
Update to 1.22.2-2~20.04.1
golang-1.13 Ubuntu:20.04:LTS
- Versions
- 1.13.1-1ubuntu1
- 1.13.3-1ubuntu1
- 1.13.4-1ubuntu1
- 1.13.5-1ubuntu1
- 1.13.6-1ubuntu1
- 1.13.6-2ubuntu1
- 1.13.7-1ubuntu1
- 1.13.8-1ubuntu1
- 1.13.8-1ubuntu1.1
- 1.13.8-1ubuntu1.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.14 Ubuntu:20.04:LTS
- Versions
- 1.14~beta1-1
- 1.14~beta1-2
- 1.14~rc1-1
- 1.14-1
- 1.14.1-1
- 1.14.2-1
- 1.14.2-1ubuntu1
- 1.14.3-2ubuntu2~20.04.1
- 1.14.3-2ubuntu2~20.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.16 Ubuntu:Pro:20.04:LTS
- Versions
- 1.16.2-0ubuntu1~20.04
- 1.16.2-0ubuntu1~20.04.1
- 1.16.2-0ubuntu1~20.04.1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.20 Ubuntu:20.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~20.04
- 1.20.3-1ubuntu0.1~20.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.17 Ubuntu:22.04:LTS
- Versions
- 1.17-1ubuntu2
- 1.17.3-1ubuntu1
- 1.17.3-1ubuntu2
- 1.17.13-3ubuntu1
- 1.17.13-3ubuntu1.2
- Affected ranges
- ECOSYSTEM: < 1.17.13-3ubuntu1.3
Update to 1.17.13-3ubuntu1.3
golang-1.18 Ubuntu:22.04:LTS
- Versions
- 1.18~beta1-0ubuntu1
- 1.18~beta2-1ubuntu1
- 1.18~beta2-1ubuntu2
- 1.18~rc1-1ubuntu1
- 1.18-1ubuntu1
- 1.18.1-1ubuntu1
- 1.18.1-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 1.18.1-1ubuntu1.2
Update to 1.18.1-1ubuntu1.2
golang-1.20 Ubuntu:22.04:LTS
- Versions
- 1.20.3-1ubuntu0.1~22.04
- 1.20.3-1ubuntu0.1~22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:22.04:LTS
- Versions
- 1.21.1-1~ubuntu22.04.1
- 1.21.1-1~ubuntu22.04.2
- Affected ranges
- ECOSYSTEM: < 1.21.1-1~ubuntu22.04.3
Update to 1.21.1-1~ubuntu22.04.3
golang-1.22 Ubuntu:22.04:LTS
- Versions
- 1.22.2-2~22.04
- Affected ranges
- ECOSYSTEM: < 1.22.2-2~22.04.1
Update to 1.22.2-2~22.04.1
golang-1.13 Ubuntu:Pro:22.04:LTS
- Versions
- 1.13.8-1ubuntu2
- 1.13.8-1ubuntu2.22.04.1
- 1.13.8-1ubuntu2.22.04.1+esm1
- 1.13.8-1ubuntu2.22.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.21 Ubuntu:24.04:LTS
- Versions
- 1.21.1-1
- 1.21.3-1
- 1.21.4-1
- 1.21.5-1
- 1.21.6-1
- 1.21.7-1
- 1.21.7-2
- 1.21.8-1
- 1.21.8-1build1
- 1.21.9-1
- Affected ranges
- ECOSYSTEM: < 1.21.9-1ubuntu0.1
Update to 1.21.9-1ubuntu0.1
Original sources
- https://go.dev/cl/585397
- https://go.dev/issue/66869
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://pkg.go.dev/vuln/GO-2024-2888
- http://www.openwall.com/lists/oss-security/2024/06/04/1
- https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
- https://security.netapp.com/advisory/ntap-20250131-0008/
- https://nvd.nist.gov/vuln/detail/CVE-2024-24789