Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-24789

Good to know:

icon

Date: June 5, 2024

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Language: Go

Severity Score

Related Resources (10)

https://pkg.go.dev/vuln/GO-2024-2888
https://github.com/golang/go/commit/cf501ac0c5fe351a8582d20b43562027927906e7
https://go.dev/cl/585397
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
http://www.openwall.com/lists/oss-security/2024/06/04/1
https://go.dev/issue/66869
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
https://nvd.nist.gov/vuln/detail/CVE-2024-24789
https://security-tracker.debian.org/tracker/CVE-2024-24789
https://www.mend.io/vulnerability-database/CVE-2024-24789

Severity Score

Top Fix

icon

Upgrade Version

Upgrade to version go1.21.11,go1.22.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us