The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolbox-testsUpgrade cockpit-podmanUpgrade udicaUpgrade container-selinuxUpgrade podman-dockerUpgrade golang-docsUpgrade podman-gvproxyUpgrade slirp4netnsUpgrade libslirpUpgrade golang-miscUpgrade golangUpgrade buildah-testsUpgrade grafanaUpgrade aardvark-dnsUpgrade podman-testsUpgrade python3-criuUpgrade critUpgrade golang-srcUpgrade go-toolsetUpgrade buildahUpgrade criuUpgrade containernetworking-pluginsUpgrade conmonUpgrade libslirp-develUpgrade criu-libsUpgrade skopeoUpgrade criu-develUpgrade golang-testsUpgrade skopeo-testsUpgrade crunUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade containers-commonUpgrade python3-podmanUpgrade netavarkUpgrade podmanUpgrade podman-remoteUpgrade toolboxUpgrade fuse-overlayfsUpgrade golang-binUpgrade delveUpgrade grafana-selinuxUpgrade podman-plugins | Jul 3, 2024 | Jun 5, 2024 |
| Alpine Linux | — | Upgrade forgejoUpgrade go | Aug 22, 2024 | Jun 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade golang-miscUpgrade golang-binUpgrade golang-testsUpgrade golangUpgrade golang-srcUpgrade golang-docsUpgrade golang-shared | Jun 26, 2024 | Jun 5, 2024 |
| Amazon_linux_2023 | — | Upgrade golang-docsUpgrade golang-miscUpgrade golangUpgrade golang-sharedUpgrade golang-binUpgrade golang-testsUpgrade golang-src | Feb 17, 2025 | Jun 4, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 5, 2024 |
| Freebsd | — | Upgrade go122Upgrade forgejoUpgrade go121 | Jun 16, 2024 | Apr 11, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade golang-develUpgrade golangUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Oct 8, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade golang-helpUpgrade golang-develUpgrade golang | Oct 9, 2024 | Jun 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade golangUpgrade golang-develUpgrade golang-help | Oct 8, 2024 | Jun 5, 2024 |
| Oracle_linux | — | Upgrade conmonUpgrade libslirpUpgrade cockpit-podmanUpgrade containers-commonUpgrade go-toolsetUpgrade delveUpgrade libslirp-develUpgrade skopeo-testsUpgrade python3-criuUpgrade slirp4netnsUpgrade podman-pluginsUpgrade criu-develUpgrade container-selinuxUpgrade podman-gvproxyUpgrade golang-srcUpgrade grafanaUpgrade podman-testsUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade criu-libsUpgrade golang-miscUpgrade golang-docsUpgrade podman-catatonitUpgrade python3-podmanUpgrade podman-remoteUpgrade criuUpgrade podman-dockerUpgrade golang-binUpgrade fuse-overlayfsUpgrade critUpgrade runcUpgrade aardvark-dnsUpgrade skopeoUpgrade podmanUpgrade buildahUpgrade udicaUpgrade golang-testsUpgrade containernetworking-pluginsUpgrade golangUpgrade buildah-testsUpgrade netavarkUpgrade grafana-selinux | Jul 3, 2024 | Jun 4, 2024 |
| Redhat Openshift | — | Upgrade openshiftUpgrade openshift-clients | Oct 2, 2024 | Jun 4, 2024 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade delve-debugsourceUpgrade toolboxUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade golangUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade python3-podmanUpgrade podman-testsUpgrade conmon-debugsourceUpgrade criu-debuginfoUpgrade grafana-debuginfoUpgrade golang-srcUpgrade slirp4netnsUpgrade conmonUpgrade criu-libsUpgrade buildah-debuginfoUpgrade netavarkUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debugsourceUpgrade buildah-testsUpgrade fuse-overlayfs-debuginfoUpgrade crun-debuginfoUpgrade delve-debuginfoUpgrade buildahUpgrade cockpit-podmanUpgrade golang-miscUpgrade containers-commonUpgrade podman-catatonit-debuginfoUpgrade fuse-overlayfsUpgrade libslirp-develUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade skopeoUpgrade runc-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade python3-criuUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade container-selinuxUpgrade golang-binUpgrade grafanaUpgrade libslirp-debugsourceUpgrade udicaUpgrade podman-remoteUpgrade grafana-selinuxUpgrade toolbox-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade golang-testsUpgrade libslirp-debuginfoUpgrade podman-debugsourceUpgrade runcUpgrade criu-develUpgrade toolbox-debugsourceUpgrade containernetworking-pluginsUpgrade go-toolsetUpgrade criuUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade podman-dockerUpgrade toolbox-debuginfoUpgrade crunUpgrade podmanUpgrade critUpgrade podman-catatonitUpgrade podman-plugins-debuginfoUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade slirp4netns-debuginfoUpgrade golang-docsUpgrade grafana-debugsourceUpgrade delveUpgrade containernetworking-plugins-debuginfo | Jul 3, 2024 | Jun 5, 2024 |
| Rocky_linux | — | Upgrade toolbox-debugsourceUpgrade grafana-debuginfoUpgrade go-toolsetUpgrade aardvark-dnsUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfsUpgrade buildahUpgrade slirp4netnsUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade criu-debuginfoUpgrade critUpgrade podman-gvproxyUpgrade runc-debugsourceUpgrade criuUpgrade libslirpUpgrade libslirp-debuginfoUpgrade podman-catatonitUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade conmonUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crunUpgrade buildah-testsUpgrade podman-testsUpgrade netavarkUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade golangUpgrade golang-binUpgrade libslirp-debugsourceUpgrade skopeo-testsUpgrade buildah-tests-debuginfoUpgrade python3-criuUpgrade podman-debugsourceUpgrade skopeoUpgrade slirp4netns-debugsourceUpgrade containernetworking-pluginsUpgrade crun-debugsourceUpgrade criu-develUpgrade criu-debugsourceUpgrade toolbox-debuginfoUpgrade grafana-selinuxUpgrade oci-seccomp-bpf-hookUpgrade grafana-debugsourceUpgrade delve-debuginfoUpgrade criu-libsUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade fuse-overlayfs-debugsourceUpgrade crun-debuginfoUpgrade runc-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade podmanUpgrade delve-debugsourceUpgrade slirp4netns-debuginfoUpgrade grafanaUpgrade delveUpgrade podman-catatonit-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade buildah-debugsourceUpgrade podman-debuginfoUpgrade containers-commonUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade podman-remoteUpgrade podman-plugins | Jul 16, 2024 | Jun 5, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.4Upgrade Splunk Universal Forwarder to version 9.4.2Upgrade Splunk Enterprise to version 9.4.2Upgrade Splunk Enterprise to version 9.2.6Upgrade Splunk Enterprise to version 9.1.9 | Jul 30, 2026 | Jun 5, 2024 |
| Suse | — | Upgrade go1.21-openssl-docUpgrade go1.22-openssl-docUpgrade go1.22-opensslUpgrade container-suseconnectUpgrade go1.21-docUpgrade go1.21-openssl-raceUpgrade go1.22Upgrade go1.22-raceUpgrade go1.22-openssl-raceUpgrade go1.21Upgrade go1.21-opensslUpgrade go1.22-docUpgrade go1.21-race | Jun 11, 2024 | Jun 5, 2024 |
| Ubuntu | — | Upgrade golang-1.18-goUpgrade golang-1.21-goUpgrade golang-1.18 (Ubuntu Pro)Upgrade golang-1.22-goUpgrade golang-1.18-go (Ubuntu Pro)Upgrade golang-1.21Upgrade golang-1.17-srcUpgrade golang-1.17-goUpgrade golang-1.22Upgrade golang-1.18Upgrade golang-1.18-src (Ubuntu Pro)Upgrade golang-1.18-srcUpgrade golang-1.21-srcUpgrade golang-1.22-srcUpgrade golang-1.17 | Jul 10, 2024 | Jun 5, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 5, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub