CVE-2024-24789

EPSS 0.01%
Veröffentlicht 05.06.2024 16:15:10
Zuletzt bearbeitet 31.01.2025 15:15:12
Quelle security@golang.org
Teams Watchlist Login
Unerledigt Login

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Golang ≫ Go Version < 1.21.11

Golang ≫ Go Version >= 1.22.0 < 1.22.4

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.01%	0.003

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0	5.3	1.8	3.4	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

http://www.openwall.com/lists/oss-security/2024/06/04/1

Mailing List

https://go.dev/cl/585397

Patch

https://go.dev/issue/66869

Patch

Issue Tracking

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/

https://pkg.go.dev/vuln/GO-2024-2888

Third Party Advisory

https://security.netapp.com/advisory/ntap-20250131-0008/

https://nvd.nist.gov/vuln/detail/CVE-2024-24789

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-24789

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-24789

EUVD