CVE-2024-24789

Mishandling of corrupt central directory record in archive/zip

Published Jun 5, 2024 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-22166 The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
Ubuntu USN Ubuntu USN USN-6886-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00012}

epss

{'score': 6e-05}

Type Values Removed Values Added
CPEs cpe:/a:redhat:ceph_storage:8.1::el9
Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:6.1::el9
Vendors & Products Redhat ceph Storage
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}

Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.6::el8
Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.5::el8
Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Security
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
Vendors & Products Redhat advanced Cluster Security
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.17::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9
Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el8
Type Values Removed Values Added
First Time appeared Redhat openshift Data Foundation
CPEs cpe:/a:redhat:openshift_data_foundation:4.16::el9
Vendors & Products Redhat openshift Data Foundation
Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.16::el9
Vendors & Products Redhat openshift
Type Values Removed Values Added
First Time appeared Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.6::el8
cpe:/a:redhat:service_mesh:2.6::el9
Vendors & Products Redhat service Mesh
Type Values Removed Values Added
First Time appeared Redhat network Observ Optr
CPEs cpe:/a:redhat:network_observ_optr:1.6.0::el9
Vendors & Products Redhat network Observ Optr