CVE-2024-24789

Mishandling of corrupt central directory record in archive/zip

Summary

Original description

The description as published by the source.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami golang

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.11"},{"introduced":"1.22.0-0"},{"fixed":"1.22.4"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2024-24789 golang-1.15
Ubuntu UBUNTU-CVE-2024-24789 golang-1.10

References

advisory pkg.go.dev
patch go.dev
patch go.dev
web groups.google.com
web openwall.com
web lists.fedoraproject.org
web security.netapp.com
web nvd.nist.gov