The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade grafana-selinuxUpgrade netavarkUpgrade skopeoUpgrade podman-pluginsUpgrade libslirp-develUpgrade python3-podmanUpgrade conmonUpgrade criu-libsUpgrade criu-develUpgrade podmanUpgrade criuUpgrade golang-testsUpgrade fuse-overlayfsUpgrade runcUpgrade crunUpgrade delveUpgrade golang-binUpgrade podman-remoteUpgrade containers-commonUpgrade skopeo-testsUpgrade toolboxUpgrade containernetworking-pluginsUpgrade udicaUpgrade python3-criuUpgrade container-selinuxUpgrade buildahUpgrade golang-docsUpgrade buildah-testsUpgrade slirp4netnsUpgrade podman-gvproxyUpgrade golangUpgrade cockpit-podmanUpgrade libslirpUpgrade critUpgrade podman-testsUpgrade podman-dockerUpgrade aardvark-dnsUpgrade go-toolsetUpgrade grafanaUpgrade golang-srcUpgrade golang-miscUpgrade toolbox-tests | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade forgejoUpgrade go | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-sharedUpgrade golang-docsUpgrade golang-miscUpgrade golang-testsUpgrade golang-binUpgrade golangUpgrade golang-src | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golangUpgrade golang-miscUpgrade golang-docsUpgrade golang-binUpgrade golang-sharedUpgrade golang-srcUpgrade golang-tests | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade forgejoUpgrade go122Upgrade go121 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golang-helpUpgrade golang | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golangUpgrade golang-helpUpgrade golang-devel | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade golang-testsUpgrade skopeoUpgrade podman-catatonitUpgrade critUpgrade containernetworking-pluginsUpgrade grafana-selinuxUpgrade aardvark-dnsUpgrade fuse-overlayfsUpgrade golang-binUpgrade podman-dockerUpgrade runcUpgrade python3-podmanUpgrade criuUpgrade netavarkUpgrade golang-miscUpgrade podmanUpgrade golangUpgrade udicaUpgrade podman-remoteUpgrade buildah-testsUpgrade buildahUpgrade golang-docsUpgrade delveUpgrade podman-testsUpgrade golang-srcUpgrade criu-develUpgrade container-selinuxUpgrade containers-commonUpgrade crunUpgrade cockpit-podmanUpgrade podman-gvproxyUpgrade grafanaUpgrade libslirpUpgrade conmonUpgrade go-toolsetUpgrade python3-criuUpgrade podman-pluginsUpgrade slirp4netnsUpgrade criu-libsUpgrade libslirp-develUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshift-clientsUpgrade openshift | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade criu-libsUpgrade golangUpgrade toolboxUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirp-develUpgrade buildah-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debugsourceUpgrade netavarkUpgrade skopeoUpgrade containers-commonUpgrade fuse-overlayfsUpgrade golang-miscUpgrade podman-gvproxyUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade cockpit-podmanUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade python3-podmanUpgrade fuse-overlayfs-debugsourceUpgrade golang-srcUpgrade conmonUpgrade criu-debuginfoUpgrade podman-catatonit-debuginfoUpgrade grafana-debuginfoUpgrade slirp4netnsUpgrade delve-debuginfoUpgrade buildahUpgrade delve-debugsourceUpgrade runc-debuginfoUpgrade podman-testsUpgrade grafanaUpgrade golang-binUpgrade golang-docsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade runcUpgrade criu-libs-debuginfoUpgrade delveUpgrade grafana-debugsourceUpgrade podman-plugins-debuginfoUpgrade runc-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade criu-debugsourceUpgrade skopeo-testsUpgrade conmon-debuginfoUpgrade libslirp-debugsourceUpgrade python3-criuUpgrade slirp4netns-debuginfoUpgrade criu-develUpgrade toolbox-debugsourceUpgrade slirp4netns-debugsourceUpgrade go-toolsetUpgrade crunUpgrade podman-pluginsUpgrade containernetworking-pluginsUpgrade container-selinuxUpgrade criuUpgrade podman-dockerUpgrade podman-debuginfoUpgrade podmanUpgrade containernetworking-plugins-debuginfoUpgrade udicaUpgrade libslirp-debuginfoUpgrade golang-testsUpgrade toolbox-testsUpgrade podman-debugsourceUpgrade podman-catatonitUpgrade podman-remoteUpgrade critUpgrade toolbox-debuginfoUpgrade grafana-selinux | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade critUpgrade aardvark-dnsUpgrade libslirpUpgrade podman-catatonitUpgrade podman-testsUpgrade podman-gvproxy-debuginfoUpgrade buildah-debuginfoUpgrade buildah-testsUpgrade golangUpgrade toolbox-testsUpgrade slirp4netnsUpgrade criuUpgrade runc-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-gvproxyUpgrade golang-binUpgrade go-toolsetUpgrade grafana-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debugsourceUpgrade conmon-debuginfoUpgrade fuse-overlayfsUpgrade buildahUpgrade criu-debuginfoUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade crunUpgrade toolboxUpgrade toolbox-debuginfoUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade slirp4netns-debugsourceUpgrade delveUpgrade grafanaUpgrade criu-develUpgrade criu-debugsourceUpgrade runcUpgrade skopeo-testsUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade slirp4netns-debuginfoUpgrade containernetworking-pluginsUpgrade podmanUpgrade delve-debugsourceUpgrade buildah-tests-debuginfoUpgrade skopeoUpgrade python3-criuUpgrade podman-debugsourceUpgrade podman-remoteUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmonUpgrade netavarkUpgrade podman-pluginsUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-develUpgrade crun-debuginfoUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-libsUpgrade containers-commonUpgrade podman-debuginfoUpgrade grafana-debugsourceUpgrade delve-debuginfoUpgrade grafana-selinuxUpgrade oci-seccomp-bpf-hookUpgrade runc-debuginfo | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Enterprise to version 9.1.9Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Universal Forwarder to version 9.4.2Upgrade Splunk Enterprise to version 9.3.4 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.22-openssl-raceUpgrade go1.22-raceUpgrade go1.21-raceUpgrade go1.22Upgrade go1.21-opensslUpgrade go1.21-openssl-raceUpgrade go1.22-docUpgrade go1.21Upgrade go1.21-openssl-docUpgrade go1.22-opensslUpgrade go1.22-openssl-docUpgrade container-suseconnectUpgrade go1.21-doc | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.18Upgrade golang-1.22Upgrade golang-1.17Upgrade golang-1.21-srcUpgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.17-goUpgrade golang-1.18-srcUpgrade golang-1.22-srcUpgrade golang-1.21-goUpgrade golang-1.17-srcUpgrade golang-1.18-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.22-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.21 | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub