The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade buildahUpgrade critUpgrade golangUpgrade podman-gvproxyUpgrade golang-srcUpgrade toolbox-testsUpgrade libslirpUpgrade cockpit-podmanUpgrade podman-dockerUpgrade udicaUpgrade python3-criuUpgrade go-toolsetUpgrade golang-docsUpgrade container-selinuxUpgrade golang-miscUpgrade podman-testsUpgrade buildah-testsUpgrade grafanaUpgrade aardvark-dnsUpgrade slirp4netnsUpgrade runcUpgrade skopeo-testsUpgrade golang-testsUpgrade criu-libsUpgrade grafana-selinuxUpgrade skopeoUpgrade criu-develUpgrade delveUpgrade fuse-overlayfsUpgrade netavarkUpgrade podman-pluginsUpgrade golang-binUpgrade conmonUpgrade podmanUpgrade criuUpgrade podman-remoteUpgrade libslirp-develUpgrade python3-podmanUpgrade toolboxUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade containers-commonUpgrade crunUpgrade oci-seccomp-bpf-hook | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade goUpgrade forgejo | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-sharedUpgrade golang-srcUpgrade golang-binUpgrade golangUpgrade golang-testsUpgrade golang-misc | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-sharedUpgrade golang-binUpgrade golang-srcUpgrade golang-tests | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade forgejoUpgrade go121 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade golang-testsUpgrade netavarkUpgrade golangUpgrade grafana-selinuxUpgrade podman-remoteUpgrade podman-catatonitUpgrade python3-podmanUpgrade golang-miscUpgrade udicaUpgrade criuUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade podman-dockerUpgrade skopeoUpgrade golang-binUpgrade runcUpgrade containernetworking-pluginsUpgrade buildahUpgrade critUpgrade golang-docsUpgrade podmanUpgrade aardvark-dnsUpgrade grafanaUpgrade podman-pluginsUpgrade criu-develUpgrade container-selinuxUpgrade podman-testsUpgrade golang-srcUpgrade podman-gvproxyUpgrade delveUpgrade crunUpgrade cockpit-podmanUpgrade libslirpUpgrade conmonUpgrade go-toolsetUpgrade slirp4netnsUpgrade python3-criuUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade containers-commonUpgrade skopeo-testsUpgrade libslirp-devel | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade openshift | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade podman-dockerUpgrade criu-develUpgrade containernetworking-pluginsUpgrade podman-debugsourceUpgrade golang-testsUpgrade runcUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade grafanaUpgrade grafana-selinuxUpgrade golang-binUpgrade udicaUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade grafana-debugsourceUpgrade toolbox-testsUpgrade podman-gvproxy-debuginfoUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade delveUpgrade skopeo-testsUpgrade python3-criuUpgrade criuUpgrade podman-debuginfoUpgrade container-selinuxUpgrade podman-pluginsUpgrade libslirp-debuginfoUpgrade golang-docsUpgrade toolbox-debuginfoUpgrade podmanUpgrade crunUpgrade go-toolsetUpgrade podman-plugins-debuginfoUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade critUpgrade toolbox-debugsourceUpgrade slirp4netns-debugsourceUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade delve-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade containers-commonUpgrade podman-gvproxyUpgrade oci-seccomp-bpf-hookUpgrade libslirpUpgrade buildahUpgrade podman-testsUpgrade slirp4netnsUpgrade criu-debuginfoUpgrade golangUpgrade buildah-debuginfoUpgrade podman-catatonit-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade netavarkUpgrade toolboxUpgrade cockpit-podmanUpgrade criu-libsUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade conmonUpgrade python3-podmanUpgrade golang-srcUpgrade fuse-overlayfs-debuginfoUpgrade delve-debugsourceUpgrade grafana-debuginfoUpgrade buildah-debugsourceUpgrade buildah-testsUpgrade aardvark-dnsUpgrade podman-remote-debuginfoUpgrade buildah-tests-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debugsourceUpgrade skopeoUpgrade golang-miscUpgrade fuse-overlayfs | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade podman-gvproxyUpgrade buildahUpgrade golang-binUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade golangUpgrade podman-testsUpgrade critUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade crunUpgrade grafana-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade conmonUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade libslirp-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade netavarkUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criuUpgrade slirp4netnsUpgrade runcUpgrade toolbox-testsUpgrade criu-debuginfoUpgrade go-toolsetUpgrade runc-debugsourceUpgrade conmon-debugsourceUpgrade podman-debugsourceUpgrade python3-criuUpgrade grafana-selinuxUpgrade grafana-debugsourceUpgrade delve-debuginfoUpgrade containers-commonUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade podman-debuginfoUpgrade podmanUpgrade slirp4netns-debuginfoUpgrade delve-debugsourceUpgrade skopeoUpgrade buildah-tests-debuginfoUpgrade grafanaUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade crun-debugsourceUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade skopeo-testsUpgrade criu-develUpgrade delveUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade criu-libs | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.4Upgrade Splunk Universal Forwarder to version 9.4.2Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Enterprise to version 9.1.9 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.21-docUpgrade container-suseconnectUpgrade go1.21-openssl-docUpgrade go1.22-opensslUpgrade go1.22-openssl-docUpgrade go1.22-docUpgrade go1.22-raceUpgrade go1.22Upgrade go1.21-opensslUpgrade go1.22-openssl-raceUpgrade go1.21Upgrade go1.21-openssl-raceUpgrade go1.21-race | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.21-srcUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.17Upgrade golang-1.22Upgrade golang-1.22-srcUpgrade golang-1.17-goUpgrade golang-1.18-srcUpgrade golang-1.18-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.21-goUpgrade golang-1.22-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.17-srcUpgrade golang-1.21 | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub