The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
Advisories
Source ID Title
EUVD EUVD EUVD-2024-22166 The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
Ubuntu USN Ubuntu USN USN-6886-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7109-1 Go vulnerabilities
Ubuntu USN Ubuntu USN USN-7111-1 Go vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Sun, 13 Jul 2025 22:45:00 +0900

Type Values Removed Values Added
Metrics epss

{'score': 0.00012}

epss

{'score': 6e-05}


Fri, 27 Jun 2025 11:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:ceph_storage:8.1::el9

Tue, 29 Apr 2025 00:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat ceph Storage
CPEs cpe:/a:redhat:ceph_storage:6.1::el9
Vendors & Products Redhat ceph Storage

Sat, 01 Feb 2025 01:15:00 +0900

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'}


Sat, 01 Feb 2025 00:30:00 +0900

Type Values Removed Values Added
References

Thu, 05 Dec 2024 00:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.6::el8

Mon, 02 Dec 2024 11:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:advanced_cluster_security:4.5::el8

Thu, 14 Nov 2024 11:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat advanced Cluster Security
CPEs cpe:/a:redhat:advanced_cluster_security:4.4::el8
Vendors & Products Redhat advanced Cluster Security

Thu, 31 Oct 2024 11:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.17::el9

Wed, 02 Oct 2024 11:15:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el9

Tue, 01 Oct 2024 23:45:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift:4.17::el8

Thu, 19 Sep 2024 03:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openshift Data Foundation
CPEs cpe:/a:redhat:openshift_data_foundation:4.16::el9
Vendors & Products Redhat openshift Data Foundation

Fri, 06 Sep 2024 22:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openshift
CPEs cpe:/a:redhat:openshift:4.16::el9
Vendors & Products Redhat openshift

Thu, 08 Aug 2024 11:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat service Mesh
CPEs cpe:/a:redhat:service_mesh:2.6::el8
cpe:/a:redhat:service_mesh:2.6::el9
Vendors & Products Redhat service Mesh

Wed, 07 Aug 2024 19:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat network Observ Optr
CPEs cpe:/a:redhat:network_observ_optr:1.6.0::el9
Vendors & Products Redhat network Observ Optr

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Go

Published:

Updated: 2025-02-13T17:40:27.816Z

Reserved: 2024-01-30T16:05:14.758Z

Link: CVE-2024-24789

cve-icon Vulnrichment

Updated: 2025-01-31T15:02:43.918Z

cve-icon NVD

Status : Modified

Published: 2024-06-05T16:15:10.470

Modified: 2025-01-31T15:15:12.740

Link: CVE-2024-24789

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-06-04T00:00:00Z

Links: CVE-2024-24789 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses