En bref
- CVE-2021-39293 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant stdlib, go (golang).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 6.9%, plus élevée que 94.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.17.1, 1.16.8 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| stdlib Go | ≥ 1.17.0-0, < 1.17.1< 1.16.8
| 1.17.11.16.8
|
| go | ≥ 1.17.0, < 1.17.1< 1.16.8
| 1.17.11.16.8
|
Description
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196.
NVD description
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free