← Volver a CVEs

CVE-2024-24789

MEDIUM

5.5

Descripcion

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Detalles CVE

Puntuacion CVSS v3.15.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Vector de ataqueLOCAL

ComplejidadLOW

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado6/5/2024

Ultima modificacion1/31/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

golang:go

Referencias

http://www.openwall.com/lists/oss-security/2024/06/04/1(security@golang.org)

https://go.dev/cl/585397(security@golang.org)

https://go.dev/issue/66869(security@golang.org)

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ(security@golang.org)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/(security@golang.org)

https://pkg.go.dev/vuln/GO-2024-2888(security@golang.org)

http://www.openwall.com/lists/oss-security/2024/06/04/1(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/cl/585397(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/issue/66869(af854a3a-2127-422b-91ae-364da2661108)

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/(af854a3a-2127-422b-91ae-364da2661108)

https://pkg.go.dev/vuln/GO-2024-2888(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20250131-0008/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.