CVE-2024-24789

Katalog CVE

CVSS 5.5 · Medium EPSS 0,45%

Kerentanan pada golang go. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Rincian

Terbit di NVD

5 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://go.dev/cl/585397 patch
• https://go.dev/issue/66869 issue tracking · patch
• https://pkg.go.dev/vuln/GO-2024-2888 advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/06/04/1 mailing list
• https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ release notes
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ...
• https://security.netapp.com/advisory/ntap-20250131-0008/