Bug 2006044 (CVE-2021-39293) - CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)
Summary: CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memo...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-39293
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2006046 2007244 2007276 2006045 2006047 2006355 2006356 2006627 2006628 2006629 2006757 2007243 2007265 2007275 2007277 2007278 2007305 2007368 2007369 2007370 2009829
Blocks: 2005869
TreeView+ depends on / blocked
 
Reported: 2021-09-20 18:34 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-05-31 09:48 UTC (History)
121 users (show)

Fixed In Version: go 1.17.1, go 1.16.8
Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files. An attacker capable of submitting a crafted ZIP file to a Go application using archive/zip to process that file could cause a denial of service via memory exhaustion or panic. This particular flaw is an incomplete fix for a previous flaw.
Clone Of:
Environment:
Last Closed: 2021-11-02 23:38:22 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4902 0 None None None 2021-12-01 17:24:18 UTC
Red Hat Product Errata RHSA-2022:0432 0 None None None 2022-02-03 16:07:47 UTC
Red Hat Product Errata RHSA-2022:0434 0 None None None 2022-02-03 18:25:11 UTC
Red Hat Product Errata RHSA-2022:0655 0 None None None 2022-02-28 20:50:20 UTC
Red Hat Product Errata RHSA-2022:1819 0 None None None 2022-05-10 13:38:41 UTC
Red Hat Product Errata RHSA-2022:4814 0 None None None 2022-05-31 09:48:54 UTC

Description Guilherme de Almeida Suckevicz 2021-09-20 18:34:44 UTC
The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.

References:
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
https://github.com/golang/go/issues/47801

Comment 1 Guilherme de Almeida Suckevicz 2021-09-20 18:35:24 UTC
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2006045]
Affects: fedora-all [bug 2006047]
Affects: openstack-rdo [bug 2006046]

Comment 22 errata-xmlrpc 2021-12-01 17:24:12 UTC
This issue has been addressed in the following products:

  RHACS-3.67-RHEL-8

Via RHSA-2021:4902 https://access.redhat.com/errata/RHSA-2021:4902

Comment 23 errata-xmlrpc 2022-02-03 16:07:40 UTC
This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:0432 https://access.redhat.com/errata/RHSA-2022:0432

Comment 24 errata-xmlrpc 2022-02-03 18:25:05 UTC
This issue has been addressed in the following products:

  Openshift Serveless 1.20

Via RHSA-2022:0434 https://access.redhat.com/errata/RHSA-2022:0434

Comment 25 errata-xmlrpc 2022-02-28 20:50:14 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2022:0655 https://access.redhat.com/errata/RHSA-2022:0655

Comment 26 errata-xmlrpc 2022-05-10 13:38:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1819 https://access.redhat.com/errata/RHSA-2022:1819

Comment 27 errata-xmlrpc 2022-05-31 09:48:48 UTC
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.6

Via RHSA-2022:4814 https://access.redhat.com/errata/RHSA-2022:4814


Note You need to log in before you can comment on or make changes to this bug.