CVE-2021-39293: High severity IBM Cloud Pak for Security vulnerability
Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By sending a specially-crafted archive header, a remote attacker could exploit this vulnerability to cause a panic, which results in a denial of service.
Other sources
In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.
— MITRE
The fix for CVE-2021-33196 can be bypassed by crafted inputs. As a result, the NewReader and OpenReader functions in archive/zip can still cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.
References: https://groups.google.com/g/golang-announce/c/dx9d7IOseHw https://github.com/golang/go/issues/47801
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-39293?
CVE-2021-39293 is a vulnerability in Go that can be exploited by a remote attacker to cause a denial of service.
How does CVE-2021-39293 impact Go?
CVE-2021-39293 can lead to a panic, resulting in a denial of service in Go.
What software versions are affected by CVE-2021-39293?
Go versions up to 1.16.8 and versions up to 1.17.1 are affected by CVE-2021-39293.
How can I fix the CVE-2021-39293 vulnerability in Go?
To fix the CVE-2021-39293 vulnerability in Go, update to version 1.16.8 or 1.17.1.
Is there any additional information available about CVE-2021-39293?
Yes, you can find more information about CVE-2021-39293 in the references provided: [Reference 1](https://access.redhat.com/security/cve/CVE-2021-33196), [Reference 2](https://groups.google.com/g/golang-announce/c/dx9d7IOseHw), [Reference 3](https://github.com/golang/go/issues/47801).