← Zuruck zu CVEs

CVE-2024-24789

MEDIUM

5.5

Beschreibung

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

CVE Details

CVSS v3.1 Bewertung5.5

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AngriffsvektorLOCAL

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht6/5/2024

Zuletzt geandert1/31/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

golang:go

Referenzen

http://www.openwall.com/lists/oss-security/2024/06/04/1(security@golang.org)

https://go.dev/cl/585397(security@golang.org)

https://go.dev/issue/66869(security@golang.org)

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ(security@golang.org)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/(security@golang.org)

https://pkg.go.dev/vuln/GO-2024-2888(security@golang.org)

http://www.openwall.com/lists/oss-security/2024/06/04/1(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/cl/585397(af854a3a-2127-422b-91ae-364da2661108)

https://go.dev/issue/66869(af854a3a-2127-422b-91ae-364da2661108)

https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/(af854a3a-2127-422b-91ae-364da2661108)

https://pkg.go.dev/vuln/GO-2024-2888(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20250131-0008/(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.