In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade delveUpgrade golang-testsUpgrade golang-raceUpgrade golang-binUpgrade golang-docsUpgrade golangUpgrade golang-miscUpgrade golang-srcUpgrade go-toolset | May 13, 2022 | Jan 24, 2022 |
| Alpine Linux | — | Upgrade go | Aug 22, 2024 | Jan 24, 2022 |
| Amazon Linux Ami 2 | — | Upgrade golang-testsUpgrade golangUpgrade golang-binUpgrade golang-docsUpgrade golang-sharedUpgrade golang-srcUpgrade golang-miscUpgrade golang-race | Sep 30, 2022 | Jan 24, 2022 |
| Amazon_linux | — | Upgrade golang | Dec 5, 2023 | Oct 7, 2021 |
| Centos_linux | — | Upgrade delveUpgrade golang-docsUpgrade golang-binUpgrade go-toolsetUpgrade golang-srcUpgrade golang-testsUpgrade delve-debugsourceUpgrade golangUpgrade golang-raceUpgrade golang-miscUpgrade delve-debuginfo | May 13, 2022 | Jan 24, 2022 |
| Debian | — | Upgrade golang-1.15 | Jan 24, 2022 | Jan 24, 2022 |
| Freebsd | — | Upgrade go | Nov 4, 2022 | Sep 10, 2021 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | May 9, 2022 | Jan 24, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Apr 26, 2022 | Jan 24, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade golangUpgrade golang-srcUpgrade golang-bin | Apr 26, 2022 | Jan 24, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Apr 19, 2022 | Jan 24, 2022 |
| Oracle_linux | — | Upgrade golang-raceUpgrade delveUpgrade golangUpgrade golang-srcUpgrade go-toolsetUpgrade golang-miscUpgrade golang-binUpgrade golang-docsUpgrade golang-tests | May 18, 2022 | Aug 18, 2021 |
| Redhat_linux | — | No solution existsUpgrade golang-srcUpgrade golang-raceUpgrade golang-testsUpgrade golangUpgrade golang-binUpgrade delve-debugsourceUpgrade golang-miscUpgrade delve-debuginfoUpgrade go-toolsetUpgrade delveUpgrade golang-docs | May 13, 2022 | Jan 24, 2022 |
| Rocky_linux | — | Upgrade delve-debuginfoUpgrade delve-debugsourceUpgrade golangUpgrade golang-binUpgrade golang-raceUpgrade delveUpgrade go-toolset | Mar 5, 2024 | Jan 24, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12 | Jul 30, 2026 | Jan 24, 2022 |
| Suse | — | Upgrade go1.17-raceUpgrade go1.16-raceUpgrade go1.16-docUpgrade go1.17Upgrade go1.17-docUpgrade go1.16 | Oct 7, 2021 | Oct 6, 2021 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 24, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub