Bug 2006044 (CVE-2021-39293)

Summary:	CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aadam, abishop, admiller, adsoni, alitke, amctagga, amuller, amurdaca, anharris, anpicker, aos-bugs, aos-install, asm, bdettelb, bmontgom, bniver, bodavis, caswilli, cbyrne, cnv-qe-bugs, crarobin, dbecker, dbenoit, deparker, dornelas, dwalsh, dymurray, emachado, eparis, erooth, etamir, fcanogab, fdeutsch, fdupont, fjansen, flucifre, gmeno, godas, hchiramm, hvyas, ibolton, jakob, jarrpa, jburrell, jcajka, jhadvig, jjoyce, jligon, jmadigan, jmatthew, jmontleo, jmulligan, jnakfour, jnovy, joelsmith, jokerman, jpadman, jschluet, jwendell, jwong, jwon, kaycoth, krathod, lball, lemenkov, lhh, lhinds, lmadsen, lmeyer, lpeer, lsm5, madam, maszulik, matzew, mbenjamin, mburns, mfojtik, mgarciac, mhackett, mnewsome, mrunge, mrussell, mthoemme, nalin, nbecker, ngough, nstielau, ocs-bugs, phoracek, pleimer, pthomas, puebele, rcernich, rfreiman, rhcos-triage, rhs-bugs, rhuss, rphillips, rrajasek, rtalur, sabose, sbatsche, sclewis, sgott, slinaber, slucidi, sostapov, spasquie, sponnaga, sseago, stirabos, sttts, team-winc, tnielsen, tstellar, tsweeney, twalsh, umohnani, vbatts, vereddy, vkumar, xxia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	go 1.17.1, go 1.16.8	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a crafted ZIP file to a Go application using archive/zip to process that file could cause a denial of service via memory exhaustion or panic. This particular flaw is an incomplete fix for a previous flaw.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 23:38:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2006046, 2006045, 2006047, 2006355, 2006356, 2006627, 2006628, 2006629, 2006757, 2007243, 2007244, 2007265, 2007275, 2007276, 2007277, 2007278, 2007305, 2007368, 2007369, 2007370, 2009829
Bug Blocks:	2005869

Description Guilherme de Almeida Suckevicz 2021-09-20 18:34:44 UTC

The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.

References:
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
https://github.com/golang/go/issues/47801

Comment 1 Guilherme de Almeida Suckevicz 2021-09-20 18:35:24 UTC

Created golang tracking bugs for this issue:

Affects: epel-all [bug 2006045]
Affects: fedora-all [bug 2006047]
Affects: openstack-rdo [bug 2006046]

Comment 2 Hardik Vyas 2021-09-21 14:07:49 UTC

Upstream patch: 

https://github.com/golang/go/commit/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b [master]
https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35 [1.17.1]
https://github.com/golang/go/commit/6c480017ae600b2c90a264a922e041df04dfa785 [1.16.8]

Comment 22 errata-xmlrpc 2021-12-01 17:24:12 UTC

This issue has been addressed in the following products:

  RHACS-3.67-RHEL-8

Via RHSA-2021:4902 https://access.redhat.com/errata/RHSA-2021:4902

Comment 23 errata-xmlrpc 2022-02-03 16:07:40 UTC

This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:0432 https://access.redhat.com/errata/RHSA-2022:0432

Comment 24 errata-xmlrpc 2022-02-03 18:25:05 UTC

This issue has been addressed in the following products:

  Openshift Serveless 1.20

Via RHSA-2022:0434 https://access.redhat.com/errata/RHSA-2022:0434

Comment 25 errata-xmlrpc 2022-02-28 20:50:14 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2022:0655 https://access.redhat.com/errata/RHSA-2022:0655

Comment 26 errata-xmlrpc 2022-05-10 13:38:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1819 https://access.redhat.com/errata/RHSA-2022:1819

Comment 27 errata-xmlrpc 2022-05-31 09:48:48 UTC

This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.6

Via RHSA-2022:4814 https://access.redhat.com/errata/RHSA-2022:4814