The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade containernetworking-pluginsUpgrade skopeoUpgrade fuse-overlayfsUpgrade grafana-selinuxUpgrade runcUpgrade libslirp-develUpgrade skopeo-testsUpgrade conmonUpgrade crunUpgrade toolboxUpgrade delveUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade golang-binUpgrade containers-commonUpgrade python3-podmanUpgrade criu-develUpgrade podman-catatonitUpgrade criuUpgrade podman-remoteUpgrade netavarkUpgrade golang-testsUpgrade podmanUpgrade critUpgrade container-selinuxUpgrade podman-dockerUpgrade podman-testsUpgrade buildahUpgrade podman-gvproxyUpgrade golang-docsUpgrade golangUpgrade grafanaUpgrade udicaUpgrade toolbox-testsUpgrade slirp4netnsUpgrade aardvark-dnsUpgrade cockpit-podmanUpgrade python3-criuUpgrade golang-srcUpgrade go-toolsetUpgrade golang-miscUpgrade libslirpUpgrade buildah-tests | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade forgejoUpgrade go | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-sharedUpgrade golang-miscUpgrade golang-testsUpgrade golang-srcUpgrade golangUpgrade golang-bin | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-docsUpgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golang-sharedUpgrade golang-src | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade go121Upgrade forgejoUpgrade go122 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade crunUpgrade delveUpgrade cockpit-podmanUpgrade grafanaUpgrade podman-gvproxyUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade golang-srcUpgrade containers-commonUpgrade container-selinuxUpgrade conmonUpgrade go-toolsetUpgrade libslirp-develUpgrade criu-develUpgrade podman-pluginsUpgrade python3-criuUpgrade slirp4netnsUpgrade skopeo-testsUpgrade libslirpUpgrade podman-testsUpgrade golang-testsUpgrade buildahUpgrade criuUpgrade python3-podmanUpgrade podman-remoteUpgrade buildah-testsUpgrade grafana-selinuxUpgrade podman-catatonitUpgrade netavarkUpgrade golangUpgrade containernetworking-pluginsUpgrade aardvark-dnsUpgrade skopeoUpgrade podman-dockerUpgrade golang-binUpgrade fuse-overlayfsUpgrade runcUpgrade critUpgrade udicaUpgrade podmanUpgrade golang-miscUpgrade golang-docs | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade openshift-clients | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade libslirp-develUpgrade skopeoUpgrade podman-gvproxyUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade crun-debugsourceUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade golangUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade golang-miscUpgrade buildah-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade delve-debuginfoUpgrade slirp4netnsUpgrade buildahUpgrade containers-commonUpgrade crun-debuginfoUpgrade cockpit-podmanUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade conmonUpgrade buildah-debugsourceUpgrade buildah-testsUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade golang-srcUpgrade fuse-overlayfs-debuginfoUpgrade grafana-debuginfoUpgrade delve-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debuginfoUpgrade podman-testsUpgrade netavarkUpgrade criu-libs-debuginfoUpgrade udicaUpgrade golang-binUpgrade delveUpgrade runc-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade golang-testsUpgrade podman-debugsourceUpgrade toolbox-testsUpgrade slirp4netns-debuginfoUpgrade python3-criuUpgrade grafana-selinuxUpgrade grafanaUpgrade podman-remoteUpgrade toolbox-debugsourceUpgrade runcUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade golang-docsUpgrade skopeo-testsUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade libslirp-debugsourceUpgrade crunUpgrade criuUpgrade podmanUpgrade podman-debuginfoUpgrade podman-dockerUpgrade toolbox-debuginfoUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netns-debugsourceUpgrade container-selinuxUpgrade go-toolsetUpgrade podman-pluginsUpgrade grafana-debugsourceUpgrade containernetworking-pluginsUpgrade crit | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade skopeoUpgrade podmanUpgrade podman-debugsourceUpgrade containers-commonUpgrade podman-debuginfoUpgrade delve-debugsourceUpgrade podman-plugins-debuginfoUpgrade python3-criuUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade criu-debugsourceUpgrade criu-develUpgrade crun-debugsourceUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade libslirp-develUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade grafanaUpgrade slirp4netns-debuginfoUpgrade grafana-debugsourceUpgrade podman-catatonit-debuginfoUpgrade criu-libsUpgrade podman-remote-debuginfoUpgrade delveUpgrade buildah-tests-debuginfoUpgrade podman-pluginsUpgrade delve-debuginfoUpgrade podman-remoteUpgrade grafana-selinuxUpgrade toolboxUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade go-toolsetUpgrade runcUpgrade runc-debugsourceUpgrade criuUpgrade criu-libs-debuginfoUpgrade fuse-overlayfsUpgrade aardvark-dnsUpgrade libslirp-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade conmon-debuginfoUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade crunUpgrade critUpgrade podman-gvproxyUpgrade criu-debuginfoUpgrade buildahUpgrade buildah-testsUpgrade golangUpgrade buildah-debuginfoUpgrade podman-testsUpgrade golang-binUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debugsourceUpgrade slirp4netnsUpgrade toolbox-testsUpgrade podman-catatonitUpgrade libslirpUpgrade grafana-debuginfoUpgrade conmon-debugsource | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Universal Forwarder to version 9.4.2Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Enterprise to version 9.1.9Upgrade Splunk Enterprise to version 9.3.4 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.21-openssl-docUpgrade go1.22-opensslUpgrade go1.21-docUpgrade container-suseconnectUpgrade go1.22-openssl-docUpgrade go1.21Upgrade go1.21-raceUpgrade go1.21-opensslUpgrade go1.22-openssl-raceUpgrade go1.22-raceUpgrade go1.21-openssl-raceUpgrade go1.22Upgrade go1.22-doc | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.21-goUpgrade golang-1.17-srcUpgrade golang-1.21Upgrade golang-1.22-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.18Upgrade golang-1.21-srcUpgrade golang-1.22-srcUpgrade golang-1.17Upgrade golang-1.17-goUpgrade golang-1.22Upgrade golang-1.18-srcUpgrade golang-1.18-src (Ubuntu Pro) | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub