Vulnerability Report: GO-2022-0273
- CVE-2021-39293
- Affects: archive/zip
- Published: May 18, 2022
- Modified: Jun 12, 2023
The NewReader and OpenReader functions in archive/zip can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size. This is caused by an incomplete fix for CVE-2021-33196.
Affected Packages
-
PathVersionsSymbols
-
before go1.16.8, from go1.17.0-0 before go1.17.1
Aliases
References
- https://go.dev/cl/343434
- https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b
- https://go.dev/issue/47801
- https://groups.google.com/g/golang-announce/c/dx9d7IOseHw
- https://vuln.go.dev/ID/GO-2022-0273.json
Credits
- OSS-Fuzz ProjectEmmanuel Odeke
Feedback
See anything missing or incorrect?
Suggest an edit to this report.