The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpit-podmanUpgrade golangUpgrade grafanaUpgrade aardvark-dnsUpgrade critUpgrade buildahUpgrade libslirpUpgrade golang-srcUpgrade python3-criuUpgrade buildah-testsUpgrade golang-miscUpgrade podman-testsUpgrade podman-dockerUpgrade golang-docsUpgrade go-toolsetUpgrade container-selinuxUpgrade toolbox-testsUpgrade podman-gvproxyUpgrade udicaUpgrade slirp4netnsUpgrade criu-develUpgrade libslirp-develUpgrade grafana-selinuxUpgrade criu-libsUpgrade netavarkUpgrade delveUpgrade podmanUpgrade fuse-overlayfsUpgrade criuUpgrade containernetworking-pluginsUpgrade podman-remoteUpgrade golang-binUpgrade podman-pluginsUpgrade skopeoUpgrade golang-testsUpgrade python3-podmanUpgrade crunUpgrade toolboxUpgrade conmonUpgrade runcUpgrade skopeo-testsUpgrade containers-commonUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade forgejoUpgrade go | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golangUpgrade golang-srcUpgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade golang-shared | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-sharedUpgrade golang-src | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade forgejoUpgrade go121 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade go-toolsetUpgrade grafanaUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade podman-pluginsUpgrade libslirp-develUpgrade cockpit-podmanUpgrade container-selinuxUpgrade criu-develUpgrade containers-commonUpgrade golang-srcUpgrade libslirpUpgrade podman-testsUpgrade podman-gvproxyUpgrade delveUpgrade conmonUpgrade skopeo-testsUpgrade crunUpgrade slirp4netnsUpgrade python3-criuUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade golang-binUpgrade critUpgrade aardvark-dnsUpgrade runcUpgrade skopeoUpgrade golangUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade golang-testsUpgrade podman-remoteUpgrade python3-podmanUpgrade grafana-selinuxUpgrade podman-catatonitUpgrade criuUpgrade golang-miscUpgrade golang-docsUpgrade buildahUpgrade udicaUpgrade podmanUpgrade netavark | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade openshift-clients | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade containernetworking-plugins-debugsourceUpgrade delve-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade criu-debuginfoUpgrade golangUpgrade conmon-debugsourceUpgrade criu-libsUpgrade python3-podmanUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade buildahUpgrade slirp4netnsUpgrade podman-testsUpgrade libslirpUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade containers-commonUpgrade golang-miscUpgrade conmonUpgrade podman-catatonit-debuginfoUpgrade buildah-debugsourceUpgrade buildah-debuginfoUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade buildah-testsUpgrade crun-debuginfoUpgrade golang-srcUpgrade grafana-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade runc-debuginfoUpgrade delve-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade toolbox-debuginfoUpgrade podman-dockerUpgrade podman-debuginfoUpgrade podmanUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade delveUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade podman-plugins-debuginfoUpgrade toolbox-testsUpgrade grafana-debugsourceUpgrade libslirp-debugsourceUpgrade podman-debugsourceUpgrade container-selinuxUpgrade criuUpgrade grafana-selinuxUpgrade podman-remoteUpgrade grafanaUpgrade golang-binUpgrade golang-testsUpgrade libslirp-debuginfoUpgrade udicaUpgrade runcUpgrade python3-criuUpgrade conmon-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade containernetworking-pluginsUpgrade toolbox-debugsourceUpgrade criu-develUpgrade crunUpgrade slirp4netns-debugsourceUpgrade podman-pluginsUpgrade go-toolsetUpgrade critUpgrade podman-catatonitUpgrade golang-docsUpgrade slirp4netns-debuginfoUpgrade skopeo-tests | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade delveUpgrade grafanaUpgrade slirp4netns-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade libslirp-develUpgrade grafana-debugsourceUpgrade grafana-selinuxUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-debugsourceUpgrade python3-criuUpgrade skopeoUpgrade delve-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade delve-debugsourceUpgrade criu-develUpgrade skopeo-testsUpgrade podmanUpgrade criu-libsUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-pluginsUpgrade podman-remoteUpgrade runcUpgrade golang-binUpgrade fuse-overlayfsUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade conmonUpgrade podman-gvproxyUpgrade buildah-debuginfoUpgrade conmon-debuginfoUpgrade golangUpgrade buildah-testsUpgrade criu-debuginfoUpgrade crunUpgrade aardvark-dnsUpgrade criuUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade podman-catatonitUpgrade conmon-debugsourceUpgrade toolbox-testsUpgrade libslirp-debuginfoUpgrade libslirpUpgrade grafana-debuginfoUpgrade critUpgrade criu-libs-debuginfoUpgrade slirp4netnsUpgrade go-toolsetUpgrade toolbox-debugsourceUpgrade runc-debugsourceUpgrade buildah | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.9Upgrade Splunk Universal Forwarder to version 9.4.2Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Enterprise to version 9.3.4 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.22-opensslUpgrade go1.22-openssl-docUpgrade container-suseconnectUpgrade go1.21-openssl-docUpgrade go1.21-docUpgrade go1.22-openssl-raceUpgrade go1.21Upgrade go1.22-docUpgrade go1.21-openssl-raceUpgrade go1.21-opensslUpgrade go1.22-raceUpgrade go1.22Upgrade go1.21-race | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.21-goUpgrade golang-1.22-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.21Upgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.18-goUpgrade golang-1.17Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.17-goUpgrade golang-1.22-srcUpgrade golang-1.21-srcUpgrade golang-1.18Upgrade golang-1.22Upgrade golang-1.18-src | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub