Input validation error in Go programming language - CVE-2024-24789

Vulnerability identifier: #VU91159

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-24789

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Go programming language
Oracle Solaris
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Fedora
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
Containers Module
openSUSE Leap
Ubuntu
openEuler
IBM Concert Software
IBM Cloud Pak for Security
Cryostat
IBM Observability with Instana
IBM Process Mining
Red Hat Advanced Cluster Security for Kubernetes
App Connect Enterprise Certified Container
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
IBM Cloud Pak for Business Automation
Nomad
moby
OpenShift Data Foundation (formerly OpenShift Container Storage)
Splunk Enterprise
QRadar Suite
Splunk Universal Forwarder
Red Hat Ceph Storage
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
golang-1.18-src (Ubuntu package)
toolbox-tests
toolbox
toolbox (Red Hat package)
udica
conmon-rs (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
restic
kitty
slirp4netns (Red Hat package)
runc
runc (Red Hat package)
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
opentofu
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
openshift-serverless-clients (Red Hat package)
fuse-overlayfs
golang
crun
crun (Red Hat package)
skopeo-tests
skopeo
golang-devel
golang-help
skopeo (Red Hat package)
golang-1.17 (Ubuntu package)
golang-1.17-go (Ubuntu package)
golang-1.17-src (Ubuntu package)
golang-1.21-src (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.21 (Ubuntu package)
delve
go-toolset
golang-tests
golang-src
golang-misc
golang-docs
golang-shared
golang-bin
golang (Red Hat package)
go1.21-doc
go1.21
go1.21-race
go1.21-openssl
go1.21-openssl-doc
go1.21-openssl-race
golang-1.22-go (Ubuntu package)
golang-1.22-src (Ubuntu package)
golang-1.22 (Ubuntu package)
go1.22-doc
go1.22
go1.22-race
go1.22-openssl
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-openssl-doc
syncthing
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
buildah
buildah-tests
rclone
containers-common
containers-common (Red Hat package)
doctl
conmon
conmon (Red Hat package)
container-suseconnect
oath-toolkit (Red Hat package)
haproxy (Red Hat package)
gh
container-selinux
container-selinux (Red Hat package)
python3-criu
criu-libs
criu-devel
criu
crit
cephadm-ansible (Red Hat package)
libslirp-devel
libslirp
libslirp (Red Hat package)
python3-podman
podman-tests
podman-remote
podman-plugins
podman-gvproxy
podman-catatonit
podman
podman-docker
openshift4-aws-iso (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
podman (Red Hat package)
grafana
grafana (Red Hat package)
ceph (Red Hat package)
ovn24.03 (Red Hat package)
ovn24.09 (Red Hat package)
cockpit-podman
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
OpenShift Serverless Client
Red Hat OpenShift Container Platform
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
Storage Protect Server
Business Automation Insights
IBM Cloud Pak System

The vulnerability allows a remote attacker to manipulate data.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip when handling zip archives. A remote attacker can create a zip file with content that will vary depending on the implementation reading the file.

Install updates from vendor's website.

• https://groups.google.com/g/golang-announce/c/XbxouI9gY7k
• https://github.com/golang/go/issues/66869