CVE-2024-24789

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24789
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/06/04/1 Mailing List
https://go.dev/cl/585397 Patch
https://go.dev/issue/66869 Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
https://pkg.go.dev/vuln/GO-2024-2888 Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/04/1 Mailing List
https://go.dev/cl/585397 Patch
https://go.dev/issue/66869 Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
https://pkg.go.dev/vuln/GO-2024-2888 Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0008/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
History

31 Jan 2025, 15:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250131-0008/ -

21 Nov 2024, 08:59

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List
References () https://go.dev/cl/585397 - Patch () https://go.dev/cl/585397 - Patch
References () https://go.dev/issue/66869 - Issue Tracking, Patch () https://go.dev/issue/66869 - Issue Tracking, Patch
References () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ -
References () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory

19 Jun 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ -

18 Jun 2024, 17:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () http://www.openwall.com/lists/oss-security/2024/06/04/1 - () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List
References () https://go.dev/cl/585397 - () https://go.dev/cl/585397 - Patch
References () https://go.dev/issue/66869 - () https://go.dev/issue/66869 - Issue Tracking, Patch
References () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes
References () https://pkg.go.dev/vuln/GO-2024-2888 - () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
First Time Golang
Golang go

10 Jun 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/06/04/1 -

06 Jun 2024, 14:17

Type Values Removed Values Added
Summary
  • (es) El manejo que hace el paquete archive/zip de ciertos tipos de archivos zip no válidos difiere del comportamiento de la mayoría de las implementaciones zip. Esta desalineación podría aprovecharse para crear un archivo zip con contenidos que varían según la implementación que lea el archivo. El paquete archive/zip ahora rechaza los archivos que contienen estos errores.

05 Jun 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-05 16:15

Updated : 2025-01-31 15:15

NVD link : CVE-2024-24789

Mitre link : CVE-2024-24789

CVE.ORG link : CVE-2024-24789

JSON object : View

Products Affected

golang

  • go
CWE
NVD-CWE-noinfo