CVE-2021-33196: Input Validation
A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files.
Other sources
Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion.
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912 https://github.com/golang/go/issues/46242
— Red Hat
Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By persuading a victim to open a specially-crafted archive file, a remote attacker could exploit this vulnerability to cause a panic or an unrecoverable fatal error, and results in a denial of service condition.
— IBM
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-33196?
CVE-2021-33196 is a vulnerability in the archive/zip package in Go before version 1.15.13 and 1.16.x before version 1.16.5.
How does the vulnerability in the archive/zip package in Go work?
The vulnerability in the archive/zip package in Go can be exploited by persuading a victim to open a specially-crafted archive file, causing a panic or unrecoverable fatal error.
What is the severity of CVE-2021-33196?
CVE-2021-33196 has a severity rating of 7.5 (high).
How do I fix the vulnerability in the archive/zip package in Go?
To fix the vulnerability, update your version of Go to at least version 1.17.0, 1.16.5, or 1.15.13, depending on your current version.
Where can I find more information about CVE-2021-33196?
You can find more information about CVE-2021-33196 in the following references: [Link 1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912), [Link 2](https://github.com/golang/go/issues/46242), [Link 3](https://golang.org/cl/322949).