CVE-2024-24789

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24789

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

T

he archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/06/04/1 Mailing List
https://go.dev/cl/585397 Patch
https://go.dev/issue/66869 Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ Release Notes
https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
https://pkg.go.dev/vuln/GO-2024-2888 Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/04/1 Mailing List
https://go.dev/cl/585397 Patch
https://go.dev/issue/66869 Issue Tracking Patch
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ Release Notes
https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/
https://pkg.go.dev/vuln/GO-2024-2888 Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0008/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*
History

31 Jan 2025, 15:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250131-0008/ -

21 Nov 2024, 08:59

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List
References () https://go.dev/cl/585397 - Patch () https://go.dev/cl/585397 - Patch
References () https://go.dev/issue/66869 - Issue Tracking, Patch () https://go.dev/issue/66869 - Issue Tracking, Patch
References () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ -
References () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory

19 Jun 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/ -

18 Jun 2024, 17:58

Type Values Removed Values Added
First Time Golang
Golang go
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
References () http://www.openwall.com/lists/oss-security/2024/06/04/1 - () http://www.openwall.com/lists/oss-security/2024/06/04/1 - Mailing List
References () https://go.dev/cl/585397 - () https://go.dev/cl/585397 - Patch
References () https://go.dev/issue/66869 - () https://go.dev/issue/66869 - Issue Tracking, Patch
References () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - () https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ - Release Notes
References () https://pkg.go.dev/vuln/GO-2024-2888 - () https://pkg.go.dev/vuln/GO-2024-2888 - Third Party Advisory
CPE cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*

10 Jun 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-05 16:15

Updated : 2025-01-31 15:15

NVD link : CVE-2024-24789

Mitre link : CVE-2024-24789

CVE.ORG link : CVE-2024-24789

JSON object : View

Products Affected

golang

CWE
NVD-CWE-noinfo