CVE-2024-24789
Publication date 5 June 2024
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.
Status
Package | Ubuntu Release | Status |
---|---|---|
golang-1.10 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
14.04 LTS trusty |
Needs evaluation
|
|
golang-1.13 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
golang-1.14 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
|
golang-1.16 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
golang-1.17 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal | Not in release | |
golang-1.18 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
golang-1.20 | 24.04 LTS noble | Not in release |
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
golang-1.21 | 24.04 LTS noble |
Fixed 1.21.9-1ubuntu0.1
|
22.04 LTS jammy |
Fixed 1.21.1-1~ubuntu22.04.3
|
|
20.04 LTS focal |
Fixed 1.21.1-1~ubuntu20.04.3
|
|
golang-1.22 | 24.04 LTS noble |
Fixed 1.22.2-2ubuntu0.1
|
22.04 LTS jammy |
Fixed 1.22.2-2~22.04.1
|
|
20.04 LTS focal |
Fixed 1.22.2-2~20.04.1
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 · Medium |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-6886-1
- Go vulnerabilities
- 9 July 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-24789
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k
- https://github.com/golang/go/issues/66869
- https://go.dev/cl/585397
- https://go.dev/issue/66869
- https://groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJ
- https://pkg.go.dev/vuln/GO-2024-2888
- https://github.com/golang/go/commit/c8e40338cf00f3c1d86c8fb23863ad67a4c72bcc (1.21)
- https://github.com/golang/go/commit/cf501ac0c5fe351a8582d20b43562027927906e7 (1.22)