The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. http://www.openwall.com/lists/oss-security/2024/06/04/1 https://go.dev/cl/585397 https://go.dev/issue/66869 https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ https://pkg.go.dev/vuln/GO-2024-2888
Created asnmap tracking bugs for this issue: Affects: fedora-all [bug 2292677] Created bettercap tracking bugs for this issue: Affects: fedora-all [bug 2292678] Created dnsx tracking bugs for this issue: Affects: fedora-all [bug 2292679] Created doctl tracking bugs for this issue: Affects: fedora-all [bug 2292680] Created exercism tracking bugs for this issue: Affects: fedora-all [bug 2292681] Created gh tracking bugs for this issue: Affects: fedora-all [bug 2292682] Created golang tracking bugs for this issue: Affects: epel-all [bug 2292670] Affects: fedora-all [bug 2292669] Created golang-github-aws-lambda tracking bugs for this issue: Affects: fedora-all [bug 2292683] Created golang-github-chai2010-gettext tracking bugs for this issue: Affects: fedora-all [bug 2292684] Created golang-github-deepmap-oapi-codegen tracking bugs for this issue: Affects: fedora-all [bug 2292685] Created golang-github-evanw-esbuild tracking bugs for this issue: Affects: fedora-all [bug 2292686] Created golang-github-facebookincubator-go2chef tracking bugs for this issue: Affects: fedora-all [bug 2292687] Created golang-github-francoispqt-gojay tracking bugs for this issue: Affects: fedora-all [bug 2292688] Created golang-github-geertjohan-rice tracking bugs for this issue: Affects: fedora-all [bug 2292689] Created golang-github-hashicorp-hc-install tracking bugs for this issue: Affects: fedora-all [bug 2292690] Created golang-github-pelletier-toml tracking bugs for this issue: Affects: fedora-all [bug 2292691] Created golang-github-pelletier-toml-2 tracking bugs for this issue: Affects: fedora-all [bug 2292692] Created golang-github-pgaskin-koboutils tracking bugs for this issue: Affects: fedora-all [bug 2292693] Created golang-github-projectdiscovery-chaos-client tracking bugs for this issue: Affects: fedora-all [bug 2292694] Created golang-github-projectdiscovery-mapcidr tracking bugs for this issue: Affects: fedora-all [bug 2292695] Created golang-github-rakyll-statik tracking bugs for this issue: Affects: fedora-all [bug 2292696] Created golang-github-rogpeppe-internal tracking bugs for this issue: Affects: fedora-all [bug 2292697] Created golang-github-schollz-croc tracking bugs for this issue: Affects: fedora-all [bug 2292698] Created golang-helm-3 tracking bugs for this issue: Affects: fedora-all [bug 2292700] Created golang-vitess tracking bugs for this issue: Affects: fedora-all [bug 2292701] Created golang-x-exp tracking bugs for this issue: Affects: fedora-all [bug 2292702] Created golang-x-mobile tracking bugs for this issue: Affects: fedora-all [bug 2292703] Created golang-x-mod tracking bugs for this issue: Affects: fedora-all [bug 2292704] Created golang-x-text tracking bugs for this issue: Affects: fedora-all [bug 2292705] Created golang-x-tools tracking bugs for this issue: Affects: fedora-all [bug 2292706] Created golang-x-vuln tracking bugs for this issue: Affects: fedora-all [bug 2292707] Created google-osconfig-agent tracking bugs for this issue: Affects: fedora-all [bug 2292708] Created gopass tracking bugs for this issue: Affects: fedora-all [bug 2292709] Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2292710] Created hugo tracking bugs for this issue: Affects: fedora-all [bug 2292711] Created kitty tracking bugs for this issue: Affects: fedora-all [bug 2292712] Created micro tracking bugs for this issue: Affects: epel-all [bug 2292671] Affects: fedora-all [bug 2292713] Created opentofu tracking bugs for this issue: Affects: fedora-all [bug 2292714] Created pack tracking bugs for this issue: Affects: epel-all [bug 2292672] Affects: fedora-all [bug 2292715] Created podman tracking bugs for this issue: Affects: fedora-all [bug 2292716] Created rclone tracking bugs for this issue: Affects: epel-all [bug 2292673] Affects: fedora-all [bug 2292717] Created restic tracking bugs for this issue: Affects: epel-all [bug 2292674] Affects: fedora-all [bug 2292718] Created snapd tracking bugs for this issue: Affects: epel-all [bug 2292675] Affects: fedora-all [bug 2292719] Created syncthing tracking bugs for this issue: Affects: epel-all [bug 2292676] Affects: fedora-all [bug 2292720] Created tinygo tracking bugs for this issue: Affects: fedora-all [bug 2292721] Created trivy tracking bugs for this issue: Affects: fedora-all [bug 2292722] Created vagrant tracking bugs for this issue: Affects: fedora-all [bug 2292723]
This appears to be fixed in Go v1.22.4 and v1.21.11. Can someone from the Go or ProdSec teams verify and add a value to the "Fixed in Version" of this BZ, please?
In reply to comment #26: > This appears to be fixed in Go v1.22.4 and v1.21.11. Can someone from the > Go or ProdSec teams verify and add a value to the "Fixed in Version" of this > BZ, please? Done!
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:4212 https://access.redhat.com/errata/RHSA-2024:4212
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:4237 https://access.redhat.com/errata/RHSA-2024:4237
This issue has been addressed in the following products: Openshift Serverless 1 on RHEL 8 Via RHSA-2024:4867 https://access.redhat.com/errata/RHSA-2024:4867
This issue has been addressed in the following products: RHOSS-1.33-RHEL-8 Via RHSA-2024:4872 https://access.redhat.com/errata/RHSA-2024:4872
This issue has been addressed in the following products: OADP-1.3-RHEL-9 Via RHSA-2024:4982 https://access.redhat.com/errata/RHSA-2024:4982
This issue has been addressed in the following products: NETWORK-OBSERVABILITY-1.6.0-RHEL-9 Via RHSA-2024:4785 https://access.redhat.com/errata/RHSA-2024:4785
This issue has been addressed in the following products: Red Hat OpenShift Service Mesh 2.6 for RHEL 8 Red Hat OpenShift Service Mesh 2.6 for RHEL 9 Via RHSA-2024:5094 https://access.redhat.com/errata/RHSA-2024:5094
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:5258 https://access.redhat.com/errata/RHSA-2024:5258
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:5291 https://access.redhat.com/errata/RHSA-2024:5291
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:6004 https://access.redhat.com/errata/RHSA-2024:6004
This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2024:6755 https://access.redhat.com/errata/RHSA-2024:6755
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:3722 https://access.redhat.com/errata/RHSA-2024:3722
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:3718 https://access.redhat.com/errata/RHSA-2024:3718
This issue has been addressed in the following products: RHODF-4.17-RHEL-9 Via RHSA-2024:8676 https://access.redhat.com/errata/RHSA-2024:8676
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9102 https://access.redhat.com/errata/RHSA-2024:9102
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9115 https://access.redhat.com/errata/RHSA-2024:9115
This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.4 Via RHSA-2024:9583 https://access.redhat.com/errata/RHSA-2024:9583
This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.5 Via RHSA-2024:10186 https://access.redhat.com/errata/RHSA-2024:10186
This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.6 Via RHSA-2024:10775 https://access.redhat.com/errata/RHSA-2024:10775