Vulnerability-Lookup

RHSA-2024:4867

Vulnerability from csaf_redhat - Published: 2024-07-25 13:11 - Updated: 2026-10-13 23:27

Summary

Red Hat Security Advisory: Release of openshift-serverless-clients kn 1.33.1 security update and bug fixes

Severity

Moderate

Notes

Topic: Red Hat openshift-serverless-clients kn 1.33.1 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Red Hat OpenShift Serverless Client kn 1.33.1 provides a CLI to interact with Red Hat OpenShift Serverless 1.33.1. The kn CLI is delivered as an RPM package for installation on RHEL platforms, and as binaries for non-Linux platforms. This release includes security, bug fixes, and enhancements. Security Fix(es): * golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789) A Red Hat Security Bulletin, which addresses further details about the Rapid Reset flaw is available in the References section. For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-24789

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next valid one. This flaw allows a malicious user to access hidden information or files inside maliciously crafted ZIP files.

5.5 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CWE-20 - Improper Input Validation

Affected products

Fixed 5 products

Product	Version	Remediation
Unresolved product id: 8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src	—	Vendor Fix fix Workaround
Unresolved product id: 8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

References

10 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:4867	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/documentation/en-us/red…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2292668	external
https://bugzilla.redhat.com/show_bug.cgi?id=2296266	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-24789	self
https://bugzilla.redhat.com/show_bug.cgi?id=2292668	external
https://www.cve.org/CVERecord?id=CVE-2024-24789	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24789	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat openshift-serverless-clients kn 1.33.1 is now available.\n\nRed Hat Product Security has rated this update as having a security impact of\t\nModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives\na detailed severity rating, is available for each vulnerability from the CVE\nlink(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Serverless Client kn 1.33.1 provides a CLI to interact with\nRed Hat OpenShift Serverless 1.33.1. The kn CLI is delivered as an RPM package\nfor installation on RHEL platforms, and as binaries for non-Linux platforms.\n\nThis release includes security, bug fixes, and enhancements.\n\nSecurity Fix(es):\n* golang: archive/zip: Incorrect handling of certain ZIP files(CVE-2024-24789)\n\nA Red Hat Security Bulletin, which addresses further details about the Rapid\nReset flaw is available in the References section.\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE page(s)\nlisted in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2024:4867",
        "url": "https://access.redhat.com/errata/RHSA-2024:4867"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1"
      },
      {
        "category": "external",
        "summary": "2292668",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292668"
      },
      {
        "category": "external",
        "summary": "2296266",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2296266"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4867.json"
      }
    ],
    "title": "Red Hat Security Advisory: Release of openshift-serverless-clients kn 1.33.1 security update and bug fixes",
    "tracking": {
      "current_release_date": "2026-10-13T23:27:07+00:00",
      "generator": {
        "date": "2026-10-13T23:27:07+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2024:4867",
      "initial_release_date": "2024-07-25T13:11:14+00:00",
      "revision_history": [
        {
          "date": "2024-07-25T13:11:14+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-07-25T13:11:14+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-13T23:27:07+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Serverless 1.0",
                "product": {
                  "name": "Red Hat OpenShift Serverless 1.0",
                  "product_id": "8Base-Openshift-Serverless-1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:serverless:1.0::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Serverless"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-serverless-clients-0:1.12.0-10.el8.src",
                "product": {
                  "name": "openshift-serverless-clients-0:1.12.0-10.el8.src",
                  "product_id": "openshift-serverless-clients-0:1.12.0-10.el8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshift-serverless-clients@1.12.0-10.el8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-serverless-clients-0:1.12.0-10.el8.x86_64",
                "product": {
                  "name": "openshift-serverless-clients-0:1.12.0-10.el8.x86_64",
                  "product_id": "openshift-serverless-clients-0:1.12.0-10.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshift-serverless-clients@1.12.0-10.el8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
                "product": {
                  "name": "openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
                  "product_id": "openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshift-serverless-clients@1.12.0-10.el8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
                "product": {
                  "name": "openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
                  "product_id": "openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshift-serverless-clients@1.12.0-10.el8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-serverless-clients-0:1.12.0-10.el8.s390x",
                "product": {
                  "name": "openshift-serverless-clients-0:1.12.0-10.el8.s390x",
                  "product_id": "openshift-serverless-clients-0:1.12.0-10.el8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openshift-serverless-clients@1.12.0-10.el8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-serverless-clients-0:1.12.0-10.el8.aarch64 as a component of Red Hat OpenShift Serverless 1.0",
          "product_id": "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64"
        },
        "product_reference": "openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
        "relates_to_product_reference": "8Base-Openshift-Serverless-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-serverless-clients-0:1.12.0-10.el8.ppc64le as a component of Red Hat OpenShift Serverless 1.0",
          "product_id": "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le"
        },
        "product_reference": "openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
        "relates_to_product_reference": "8Base-Openshift-Serverless-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-serverless-clients-0:1.12.0-10.el8.s390x as a component of Red Hat OpenShift Serverless 1.0",
          "product_id": "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x"
        },
        "product_reference": "openshift-serverless-clients-0:1.12.0-10.el8.s390x",
        "relates_to_product_reference": "8Base-Openshift-Serverless-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-serverless-clients-0:1.12.0-10.el8.src as a component of Red Hat OpenShift Serverless 1.0",
          "product_id": "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src"
        },
        "product_reference": "openshift-serverless-clients-0:1.12.0-10.el8.src",
        "relates_to_product_reference": "8Base-Openshift-Serverless-1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-serverless-clients-0:1.12.0-10.el8.x86_64 as a component of Red Hat OpenShift Serverless 1.0",
          "product_id": "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64"
        },
        "product_reference": "openshift-serverless-clients-0:1.12.0-10.el8.x86_64",
        "relates_to_product_reference": "8Base-Openshift-Serverless-1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-24789",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-06-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2292668"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next valid one. This flaw allows a malicious user to access hidden information or files inside maliciously crafted ZIP files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: archive/zip: Incorrect handling of certain ZIP files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate impact: this issue affects Red Hat products and Community Projects that ship components using Go\u0027s archive/zip library, with affected records across Community Projects, Red Hat OpenShift AI, Core, Hybrid Cloud, and Portfolio products. A local attacker with low privileges can cause software using the library to process a maliciously crafted ZIP with a corrupted central-directory record; the library may skip the invalid record and process a later valid one, so different ZIP implementations can expose or process different contents, including hidden information or files. Red Hat\u0027s CVSS is 5.5 (Moderate), matching NIST\u0027s score; CISA also rates it Moderate at 5.3. Some current product records are marked not affected because their assessed components are outside the affected component scope; the record does not provide a more specific technical rationale for those exclusions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
          "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
          "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x",
          "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src",
          "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24789"
        },
        {
          "category": "external",
          "summary": "RHBZ#2292668",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2292668"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24789",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24789"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24789",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24789"
        }
      ],
      "release_date": "2024-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-07-25T13:11:14+00:00",
          "details": "See the Red Hat OpenShift serverless 1 documentation at: \nhttps://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1",
          "product_ids": [
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2024:4867"
        },
        {
          "category": "workaround",
          "details": "For affected products, apply vendor-provided updates when available. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.aarch64",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.ppc64le",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.s390x",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.src",
            "8Base-Openshift-Serverless-1:openshift-serverless-clients-0:1.12.0-10.el8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: archive/zip: Incorrect handling of certain ZIP files"
    }
  ]
}

CVE-2024-24789 (GCVE-0-2024-24789)

Vulnerability from cvelistv5 – Published: 2024-06-05 15:13 – Updated: 2025-02-13 17:40

Title

Mishandling of corrupt central directory record in archive/zip

Summary

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-06 15:26 UTC

CWE

CWE-390 - Detection of Error Condition Without Action

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 75 records in the last 180 days details

References

7 references

URL	Tags
https://go.dev/cl/585397
https://go.dev/issue/66869
https://groups.google.com/g/golang-announce/c/Xbx…
https://pkg.go.dev/vuln/GO-2024-2888
http://www.openwall.com/lists/oss-security/2024/06/04/1
https://lists.fedoraproject.org/archives/list/pac…
https://security.netapp.com/advisory/ntap-2025013…

Impacted products

2 products

Vendor	Product	Version
Go standard library	archive/zip	Affected: 0 , < 1.21.11 (semver) Affected: 1.22.0-0 , < 1.22.4 (semver)
golang	go	Affected: 0 , < 1.21.11 (semver) Affected: 1.22.0 , < 1.22.4 (semver) cpe:2.3:a:golang:go::::::::

Credits

Yufan You (@ouuan)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "go",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "1.21.11",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.22.4",
                "status": "affected",
                "version": "1.22.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24789",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-06T15:26:12.977985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-13T16:20:49.160Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-31T15:02:43.918Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/585397"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/66869"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2888"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/04/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250131-0008/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "archive/zip",
          "product": "archive/zip",
          "programRoutines": [
            {
              "name": "findSignatureInBlock"
            },
            {
              "name": "NewReader"
            },
            {
              "name": "OpenReader"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.4",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Yufan You (@ouuan)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The archive/zip package\u0027s handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-390: Detection of Error Condition Without Action",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-19T03:05:53.965Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/585397"
        },
        {
          "url": "https://go.dev/issue/66869"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2888"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/04/1"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5YAEIA6IUHUNGJ7AIXXPQT6D2GYENX7/"
        }
      ],
      "title": "Mishandling of corrupt central directory record in archive/zip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24789",
    "datePublished": "2024-06-05T15:13:51.938Z",
    "dateReserved": "2024-01-30T16:05:14.758Z",
    "dateUpdated": "2025-02-13T17:40:27.816Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2024:4867

CVE-2024-24789 (GCVE-0-2024-24789)

Tags

Sightings

Nomenclature

Related by attack behaviour