Bug 2006044 (CVE-2021-39293) - CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)
Summary: CVE-2021-39293 golang: archive/zip: malformed archive may cause panic or memo...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-39293
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2006045 2006046 2006047 2006355 2006356 2006627 2006628 2006629 2006757 2007243 2007244 2007265 2007275 2007276 2007277 2007278 2007305 2007368 2007369 2007370 2009829
Blocks: 2005869
TreeView+ depends on / blocked
 
Reported: 2021-09-20 18:34 UTC by Guilherme de Almeida Suckevicz
Modified: 2024-03-15 03:05 UTC (History)
122 users (show)

Fixed In Version: go 1.17.1, go 1.16.8
Clone Of:
Environment:
Last Closed: 2021-11-02 23:38:22 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:4902 0 None None None 2021-12-01 17:24:18 UTC
Red Hat Product Errata RHSA-2022:0432 0 None None None 2022-02-03 16:07:47 UTC
Red Hat Product Errata RHSA-2022:0434 0 None None None 2022-02-03 18:25:11 UTC
Red Hat Product Errata RHSA-2022:0655 0 None None None 2022-02-28 20:50:20 UTC
Red Hat Product Errata RHSA-2022:1819 0 None None None 2022-05-10 13:38:41 UTC
Red Hat Product Errata RHSA-2022:4814 0 None None None 2022-05-31 09:48:54 UTC

Description Guilherme de Almeida Suckevicz 2021-09-20 18:34:44 UTC 
The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.

References:
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
https://github.com/golang/go/issues/47801
Comment 1 Guilherme de Almeida Suckevicz 2021-09-20 18:35:24 UTC 
Created golang tracking bugs for this issue:

Affects: epel-all [bug 2006045]
Affects: fedora-all [bug 2006047]
Affects: openstack-rdo [bug 2006046]
Comment 2 Hardik Vyas 2021-09-21 14:07:49 UTC 
Upstream patch: 

https://github.com/golang/go/commit/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b [master]
https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35 [1.17.1]
https://github.com/golang/go/commit/6c480017ae600b2c90a264a922e041df04dfa785 [1.16.8]
Comment 22 errata-xmlrpc 2021-12-01 17:24:12 UTC 
This issue has been addressed in the following products:

  RHACS-3.67-RHEL-8

Via RHSA-2021:4902 https://access.redhat.com/errata/RHSA-2021:4902
Comment 23 errata-xmlrpc 2022-02-03 16:07:40 UTC 
This issue has been addressed in the following products:

  Openshift Serverless 1 on RHEL 8

Via RHSA-2022:0432 https://access.redhat.com/errata/RHSA-2022:0432
Comment 24 errata-xmlrpc 2022-02-03 18:25:05 UTC 
This issue has been addressed in the following products:

  Openshift Serveless 1.20

Via RHSA-2022:0434 https://access.redhat.com/errata/RHSA-2022:0434
Comment 25 errata-xmlrpc 2022-02-28 20:50:14 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.9

Via RHSA-2022:0655 https://access.redhat.com/errata/RHSA-2022:0655
Comment 26 errata-xmlrpc 2022-05-10 13:38:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:1819 https://access.redhat.com/errata/RHSA-2022:1819
Comment 27 errata-xmlrpc 2022-05-31 09:48:48 UTC 
This issue has been addressed in the following products:

  Red Hat Migration Toolkit for Containers 1.6

Via RHSA-2022:4814 https://access.redhat.com/errata/RHSA-2022:4814
Note You need to log in before you can comment on or make changes to this bug.