The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade container-selinuxUpgrade podman-gvproxyUpgrade podman-testsUpgrade golang-miscUpgrade toolbox-testsUpgrade buildah-testsUpgrade libslirpUpgrade golangUpgrade cockpit-podmanUpgrade udicaUpgrade slirp4netnsUpgrade golang-srcUpgrade aardvark-dnsUpgrade podman-dockerUpgrade grafanaUpgrade critUpgrade python3-criuUpgrade golang-docsUpgrade buildahUpgrade go-toolsetUpgrade delveUpgrade podmanUpgrade podman-catatonitUpgrade criu-libsUpgrade runcUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade python3-podmanUpgrade libslirp-develUpgrade skopeoUpgrade grafana-selinuxUpgrade crunUpgrade criu-develUpgrade podman-remoteUpgrade containers-commonUpgrade toolboxUpgrade oci-seccomp-bpf-hookUpgrade conmonUpgrade netavarkUpgrade skopeo-testsUpgrade golang-testsUpgrade criuUpgrade podman-pluginsUpgrade golang-bin | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade forgejoUpgrade go | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-docsUpgrade golang-sharedUpgrade golang-miscUpgrade golang-testsUpgrade golang-binUpgrade golang-srcUpgrade golang | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-miscUpgrade golangUpgrade golang-binUpgrade golang-testsUpgrade golang-sharedUpgrade golang-src | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade forgejoUpgrade go122Upgrade go121 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golangUpgrade golang-devel | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade libslirp-develUpgrade libslirpUpgrade delveUpgrade skopeo-testsUpgrade crunUpgrade conmonUpgrade go-toolsetUpgrade criu-libsUpgrade grafanaUpgrade oci-seccomp-bpf-hookUpgrade slirp4netnsUpgrade podman-pluginsUpgrade criu-develUpgrade python3-criuUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade containers-commonUpgrade golang-srcUpgrade podman-testsUpgrade container-selinuxUpgrade buildah-testsUpgrade podman-dockerUpgrade critUpgrade golang-binUpgrade netavarkUpgrade golangUpgrade containernetworking-pluginsUpgrade buildahUpgrade aardvark-dnsUpgrade skopeoUpgrade criuUpgrade golang-miscUpgrade golang-docsUpgrade runcUpgrade podman-catatonitUpgrade grafana-selinuxUpgrade podman-remoteUpgrade python3-podmanUpgrade podmanUpgrade udicaUpgrade golang-testsUpgrade fuse-overlayfs | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade openshift | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade slirp4netns-debuginfoUpgrade libslirp-debuginfoUpgrade grafana-selinuxUpgrade libslirp-debugsourceUpgrade runc-debugsourceUpgrade golang-docsUpgrade grafana-debugsourceUpgrade go-toolsetUpgrade criuUpgrade udicaUpgrade golang-binUpgrade criu-debugsourceUpgrade podman-remoteUpgrade grafanaUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade criu-develUpgrade conmon-debuginfoUpgrade python3-criuUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podmanUpgrade podman-debuginfoUpgrade runcUpgrade delveUpgrade podman-dockerUpgrade podman-plugins-debuginfoUpgrade skopeo-testsUpgrade podman-catatonitUpgrade toolbox-debugsourceUpgrade toolbox-testsUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade podman-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-debugsourceUpgrade critUpgrade crunUpgrade golang-testsUpgrade buildah-debuginfoUpgrade conmonUpgrade fuse-overlayfs-debuginfoUpgrade runc-debuginfoUpgrade buildah-testsUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade golangUpgrade criu-debuginfoUpgrade podman-gvproxyUpgrade containers-commonUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade skopeoUpgrade buildah-debugsourceUpgrade aardvark-dnsUpgrade crun-debuginfoUpgrade cockpit-podmanUpgrade libslirpUpgrade oci-seccomp-bpf-hookUpgrade conmon-debugsourceUpgrade podman-catatonit-debuginfoUpgrade delve-debugsourceUpgrade fuse-overlayfsUpgrade slirp4netnsUpgrade golang-miscUpgrade buildah-tests-debuginfoUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade crun-debugsourceUpgrade netavarkUpgrade libslirp-develUpgrade podman-testsUpgrade grafana-debuginfoUpgrade delve-debuginfoUpgrade buildahUpgrade python3-podmanUpgrade golang-src | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade conmon-debugsourceUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade toolbox-testsUpgrade grafana-debuginfoUpgrade aardvark-dnsUpgrade podman-gvproxy-debuginfoUpgrade libslirpUpgrade conmon-debuginfoUpgrade podman-testsUpgrade golang-binUpgrade golangUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildahUpgrade podman-gvproxyUpgrade criu-libs-debuginfoUpgrade go-toolsetUpgrade criuUpgrade runc-debugsourceUpgrade runcUpgrade slirp4netnsUpgrade critUpgrade crunUpgrade criu-debuginfoUpgrade toolbox-debugsourceUpgrade conmonUpgrade containernetworking-plugins-debugsourceUpgrade libslirp-debuginfoUpgrade netavarkUpgrade toolbox-debuginfoUpgrade delve-debuginfoUpgrade criu-libsUpgrade oci-seccomp-bpf-hookUpgrade grafana-selinuxUpgrade grafana-debugsourceUpgrade toolboxUpgrade podman-remote-debuginfoUpgrade podman-remoteUpgrade podman-pluginsUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade python3-criuUpgrade skopeoUpgrade podman-debugsourceUpgrade podmanUpgrade delve-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade criu-debugsourceUpgrade criu-develUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade grafanaUpgrade delveUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsource | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.4Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Enterprise to version 9.1.9Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Universal Forwarder to version 9.4.2 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.21-openssl-raceUpgrade go1.22Upgrade go1.21-raceUpgrade go1.22-raceUpgrade go1.21-opensslUpgrade go1.21Upgrade go1.22-openssl-raceUpgrade go1.22-docUpgrade go1.22-openssl-docUpgrade go1.21-openssl-docUpgrade container-suseconnectUpgrade go1.21-docUpgrade go1.22-openssl | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.22Upgrade golang-1.22-srcUpgrade golang-1.18-srcUpgrade golang-1.17Upgrade golang-1.21-srcUpgrade golang-1.17-goUpgrade golang-1.21-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.18-goUpgrade golang-1.21Upgrade golang-1.17-srcUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.22-go | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub