GO-2022-0273
Panic due to crafted inputs in archive/zip
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-39293
- Alias
- BIT-golang-2021-39293
Description
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · stdlib | introduced 0, fixed 1.16.8, introduced 1.17.0-0, fixed 1.17.1 |
Références
- https://go.dev/cl/343434 FIX
- https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b FIX
- https://go.dev/issue/47801 REPORT
- https://groups.google.com/g/golang-announce/c/dx9d7IOseHw WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |