Input validation error in Go programming language - CVE-2024-24789

Vulnerability identifier: #VU91159

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24789

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to manipulate data.

The vulnerability exists due to insufficient validation of user-supplied input in archive/zip when handling zip archives. A remote attacker can create a zip file with content that will vary depending on the implementation reading the file.

Go programming language
Oracle Solaris
Amazon Linux AMI
Oracle Linux
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for x86_64
Fedora
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Development Tools Module
Containers Module
openSUSE Leap
Ubuntu
openEuler
IBM Concert Software
IBM Cloud Pak for Security
Cryostat
IBM Observability with Instana
IBM Process Mining
Red Hat Advanced Cluster Security for Kubernetes
App Connect Enterprise Certified Container
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Spectrum Protect Plus
IBM Cloud Pak for Business Automation
Nomad
moby
OpenShift Data Foundation (formerly OpenShift Container Storage)
Splunk Enterprise
QRadar Suite
Splunk Universal Forwarder
Red Hat Ceph Storage
golang-1.18 (Ubuntu package)
golang-1.18-go (Ubuntu package)
golang-1.18-src (Ubuntu package)
toolbox-tests
toolbox
toolbox (Red Hat package)
udica
conmon-rs (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
restic
kitty
slirp4netns (Red Hat package)
runc
runc (Red Hat package)
slirp4netns
oci-seccomp-bpf-hook
containernetworking-plugins (Red Hat package)
containernetworking-plugins
opentofu
aardvark-dns
fuse-overlayfs (Red Hat package)
netavark
openshift-serverless-clients (Red Hat package)
fuse-overlayfs
golang
crun
crun (Red Hat package)
skopeo-tests
skopeo
golang-devel
golang-help
skopeo (Red Hat package)
golang-1.17 (Ubuntu package)
golang-1.17-go (Ubuntu package)
golang-1.17-src (Ubuntu package)
golang-1.21-src (Ubuntu package)
golang-1.21-go (Ubuntu package)
golang-1.21 (Ubuntu package)
delve
go-toolset
golang-tests
golang-src
golang-misc
golang-docs
golang-shared
golang-bin
golang (Red Hat package)
go1.21-doc
go1.21
go1.21-race
go1.21-openssl
go1.21-openssl-doc
go1.21-openssl-race
golang-1.22-go (Ubuntu package)
golang-1.22-src (Ubuntu package)
golang-1.22 (Ubuntu package)
go1.22-doc
go1.22
go1.22-race
go1.22-openssl
go1.22-openssl-debuginfo
go1.22-openssl-race
go1.22-openssl-doc
syncthing
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
buildah
buildah-tests
rclone
containers-common
containers-common (Red Hat package)
doctl
conmon
conmon (Red Hat package)
container-suseconnect
oath-toolkit (Red Hat package)
haproxy (Red Hat package)
gh
container-selinux
container-selinux (Red Hat package)
python3-criu
criu-libs
criu-devel
criu
crit
cephadm-ansible (Red Hat package)
libslirp-devel
libslirp
libslirp (Red Hat package)
python3-podman
podman-tests
podman-remote
podman-plugins
podman-gvproxy
podman-catatonit
podman
podman-docker
openshift4-aws-iso (Red Hat package)
ose-aws-ecr-image-credential-provider (Red Hat package)
ose-azure-acr-image-credential-provider (Red Hat package)
ose-gcp-gcr-image-credential-provider (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
podman (Red Hat package)
grafana
grafana (Red Hat package)
ceph (Red Hat package)
ovn24.03 (Red Hat package)
ovn24.09 (Red Hat package)
cockpit-podman
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
OpenShift Serverless Client
Red Hat OpenShift Container Platform
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
Storage Protect Server
Business Automation Insights
IBM Cloud Pak System

Install updates from vendor's website.

Go programming language - addressed in versions 1.21.11, 1.22.4
Oracle Solaris - update to 11.4 SRU 71
IBM Concert Software - update to 1.0.5
Nomad - update to 1.8.1
Splunk Enterprise - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
Splunk Universal Forwarder - addressed in versions 9.1.9, 9.2.6, 9.3.4, 9.4.2
moby - update to 26.1.4
IBM Observability with Instana - addressed in versions 279, 282
golang-1.18 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-go (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
golang-1.18-src (Ubuntu package) - addressed in versions Ubuntu Pro, 1.18.1-1ubuntu1.2, 1.18.1-1ubuntu1~20.04.3
toolbox-tests - update to 0.0.99.5-2.0.1
toolbox - update to 0.0.99.5-2.0.1
toolbox (Red Hat package) - addressed in versions 0.1.0-3.rhaos4.17.el8, 0.1.2-1.rhaos4.17.el9
udica - update to 0.2.6-21
conmon-rs (Red Hat package) - addressed in versions 0.6.3-1.rhaos4.17.el8, 0.6.3-1.rhaos4.17.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.16.0-17.gitf6c51c9.el9
restic - addressed in versions 0.17.0-1.fc41, 0.17.0-1.fc42
kitty - addressed in versions 0.35.1-4.fc40, 0.35.1-4.fc41
slirp4netns (Red Hat package) - update to 1.1.8-3.rhaos4.17.el8
runc - update to 1.1.12-4.0.1
runc (Red Hat package) - addressed in versions 1.1.13-2.rhaos4.17.el8, 1.1.13-4.rhaos4.17.el9
slirp4netns - update to 1.2.3-1
oci-seccomp-bpf-hook - update to 1.2.10-1
OpenShift API for Data Protection (OADP) - update to 1.3.3
containernetworking-plugins (Red Hat package) - update to 1.4.0-3.rhaos4.17.el8
containernetworking-plugins - update to 1.4.0-5.0.1
Network Observability plugin for the Openshift Console - update to 1.6.1
opentofu - addressed in versions 1.7.3-3.fc39, 1.7.3-3.fc40, 1.7.3-3.fc41, 1.8.0-1.fc39, 1.8.0-1.fc40
aardvark-dns - update to 1.10.0-2.0.1
fuse-overlayfs (Red Hat package) - update to 1.10-3.rhaos4.17.el8
netavark - update to 1.10.3-1.0.1
QRadar Suite - update to 1.10.26.0
openshift-serverless-clients (Red Hat package) - update to 1.12.0-10.el8
fuse-overlayfs - update to 1.13-1.0.1
golang - update to 1.13.4-1.57
crun - update to 1.14.3-2
crun (Red Hat package) - addressed in versions 1.14.3-2.rhaos4.17.el8, 1.14.3-2.rhaos4.17.el9
skopeo-tests - update to 1.14.5-3.0.1
skopeo - update to 1.14.5-3.0.1
IBM Process Mining - update to 1.15.0 IF003
golang - addressed in versions 1.15.7-45, 1.17.3-34, 1.21.4-13
golang-devel - addressed in versions 1.15.7-45, 1.17.3-34, 1.21.4-13
golang-help - addressed in versions 1.15.7-45, 1.17.3-34, 1.21.4-13
skopeo (Red Hat package) - addressed in versions 1.16.0-2.rhaos4.17.el8, 1.16.0-2.rhaos4.17.el9
golang-1.17 (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17-go (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.17-src (Ubuntu package) - update to 1.17.13-3ubuntu1.3
golang-1.21-src (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21-go (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
golang-1.21 (Ubuntu package) - addressed in versions 1.21.1-1~ubuntu20.04.3, 1.21.1-1~ubuntu22.04.3, 1.21.9-1ubuntu0.1
delve - update to 1.21.2-3
go-toolset - update to 1.21.11-1
golang-tests - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang-src - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang-misc - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang-docs - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang-shared - update to 1.21.11-1
golang-bin - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang - addressed in versions 1.21.11-1, 1.21.11-1.0.1
golang (Red Hat package) - update to 1.21.11-1.el9_4
go1.21-doc - addressed in versions 1.21.11-1.36.1, 1.21.11-150000.1.36.1
go1.21 - addressed in versions 1.21.11-1.36.1, 1.21.11-150000.1.36.1
go1.21-race - update to 1.21.11-150000.1.36.1
go1.21-openssl - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-doc - update to 1.21.13.1-150600.16.3.1
go1.21-openssl-race - update to 1.21.13.1-150600.16.3.1
golang-1.22-go (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22-src (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
golang-1.22 (Ubuntu package) - addressed in versions 1.22.2-2ubuntu0.1, 1.22.2-2~22.04.1
go1.22-doc - addressed in versions 1.22.4-1.12.1, 1.22.4-150000.1.18.1
go1.22 - addressed in versions 1.22.4-1.12.1, 1.22.4-150000.1.18.1
go1.22-race - update to 1.22.4-150000.1.18.1
go1.22-openssl - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-debuginfo - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-race - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
go1.22-openssl-doc - addressed in versions 1.22.7.1-150000.1.3.1, 1.22.7.1-150600.13.3.1
syncthing - addressed in versions 1.28.0-1.el8, 1.28.0-1.el9, 1.28.0-1.fc39, 1.28.0-1.fc40, 1.28.0-1.fc41
cri-tools (Red Hat package) - addressed in versions 1.30.0-4.el8, 1.30.0-4.el9
cri-o (Red Hat package) - addressed in versions 1.30.5-7.rhaos4.17.git2e89940.el8, 1.30.5-7.rhaos4.17.git2e89940.el9
OpenShift Serverless Client - update to 1.33.1
buildah (Red Hat package) - addressed in versions 1.33.7-2.rhaos4.17.el8, 1.33.7-2.rhaos4.17.el9
buildah - update to 1.34.0-1
buildah-tests - update to 1.34.0-1
rclone - addressed in versions 1.67.0-1.fc41, 1.70.3-1.el9
containers-common - update to 1-82.0.1
containers-common (Red Hat package) - addressed in versions 1-86.rhaos4.17.el8, 1-86.rhaos4.17.el9
doctl - update to 1.120.0-1.fc42
conmon - update to 2.1.10-1
conmon (Red Hat package) - addressed in versions 2.1.12-4.rhaos4.17.el8, 2.1.12-4.rhaos4.17.el9
Storage Copy Data Management - update to 2.2.24.1
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
container-suseconnect - update to 2.5.0-150000.4.55.1
oath-toolkit (Red Hat package) - update to 2.6.12-1.el9cp
haproxy (Red Hat package) - update to 2.8.10-1.rhaos4.17.el9
gh - update to 2.63.2-1.fc42
container-selinux - update to 2.229.0-2
container-selinux (Red Hat package) - addressed in versions 2.231.0-3.rhaos4.17.el8, 2.231.0-3.rhaos4.17.el9
python3-criu - update to 3.18-5.0.1
criu-libs - update to 3.18-5.0.1
criu-devel - update to 3.18-5.0.1
criu - update to 3.18-5.0.1
crit - update to 3.18-5.0.1
cephadm-ansible (Red Hat package) - update to 4.1.4-1.el9cp
libslirp-devel - update to 4.4.0-2
libslirp - update to 4.4.0-2
libslirp (Red Hat package) - update to 4.4.0-5.rhaos4.17.el8
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.4.6, 4.5.5, 4.6.0
IBM Cloud Pak for Watson AIOps - update to 4.8.1
python3-podman - update to 4.9.0-2
podman-tests - update to 4.9.4-12.0.1
podman-remote - update to 4.9.4-12.0.1
podman-plugins - update to 4.9.4-12.0.1
podman-gvproxy - update to 4.9.4-12.0.1
podman-catatonit - update to 4.9.4-12.0.1
podman - update to 4.9.4-12.0.1
podman-docker - update to 4.9.4-12.0.1
Red Hat OpenShift Container Platform - addressed in versions 4.13.52, 4.16.10, 4.17.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.16.2, 4.17.0
openshift4-aws-iso (Red Hat package) - update to 4.17.0-202404161335.p0.gd2acdd5.assembly.stream.el8
ose-aws-ecr-image-credential-provider (Red Hat package) - addressed in versions 4.17.0-202406261807.p0.g8c77f41.assembly.stream.el8, 4.17.0-202406261807.p0.g8c77f41.assembly.stream.el9
ose-azure-acr-image-credential-provider (Red Hat package) - addressed in versions 4.17.0-202406261807.p0.gb9204e2.assembly.stream.el8, 4.17.0-202406261807.p0.gb9204e2.assembly.stream.el9
ose-gcp-gcr-image-credential-provider (Red Hat package) - addressed in versions 4.17.0-202408061615.p0.g8ce997d.assembly.stream.el8, 4.17.0-202408061615.p0.g8ce997d.assembly.stream.el9
openshift-ansible (Red Hat package) - addressed in versions 4.17.0-202409041737.p0.g7fe7411.assembly.stream.el8, 4.17.0-202409041737.p0.g7fe7411.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el8, 4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el8, 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el9
App Connect Enterprise Certified Container - addressed in versions 5.0.19, 12.0.2, 12.1.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1
podman (Red Hat package) - addressed in versions 5.2.0-2.rhaos4.17.el9, 5.2.0-3.rhaos4.17.el8, 5.2.2-1.el9
Red Hat Ceph Storage - addressed in versions 6.1, 8.1
Storage Protect Server - update to 8.1.24
grafana - update to 9.2.10-17.0.1
IBM Spectrum Protect Plus - update to 10.1.6.4
grafana (Red Hat package) - update to 10.2.6-4.el9
ceph (Red Hat package) - update to 19.2.1-222.el9cp
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3-IF037, 24.0.0-IF003
Business Automation Insights - update to 24.0.0.0.1
ovn24.03 (Red Hat package) - update to 24.03.1-36.el9fdp
ovn24.09 (Red Hat package) - update to 24.09.0 beta.26.el9fdp
cockpit-podman - update to 84.1-1

• https://groups.google.com/g/golang-announce/c/XbxouI9gY7k
• https://github.com/golang/go/issues/66869

• Multiple vulnerabilities in Go programming language
• Multiple vulnerabilities in Moby
• SUSE update for go1.22
• SUSE update for go1.21
• SUSE update for go1.21
• SUSE update for go1.22
• Fedora 40 update for kitty
• Fedora 41 update for kitty
• HashiCorp Nomad update for go
• openEuler 22.03 LTS SP3 update for golang
• openEuler 20.03 LTS SP4 update for golang
• openEuler 22.03 LTS SP1 update for golang
• Amazon Linux AMI update for golang
• openEuler 24.03 LTS update for golang
• Red Hat Enterprise Linux 9 update for golang
• Ubuntu update for golang-1.21
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for go-toolset module
• Input validation error in OpenShift Serverless Client 1.33
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console 1.6
• Fedora 41 update for opentofu
• Fedora 39 update for opentofu
• Fedora 40 update for opentofu
• Fedora 39 update for opentofu
• Fedora 40 update for opentofu
• Fedora 41 update for rclone
• Red Hat Enterprise Linux 8 update for the container-tools:rhel8 module
• Fedora 42 update for restic
• Fedora 41 update for restic
• Multiple vulnerabilities in Red Hat build of Cryostat 3 on RHEL 8
• Input validation error in IBM App Connect Enterprise Certified Container
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in IBM Observability with Instana
• SUSE update for container-suseconnect
• Multiple vulnerabilities in IBM Instana Observability
• Multiple vulnerabilities in IBM Storage Copy Data Management
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.16
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM Process Mining
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• IBM Storage Protect Server update for Golang Go
• SUSE update for go1.21-openssl
• Fedora EPEL 8 update for syncthing
• Fedora 39 update for syncthing
• Fedora EPEL 9 update for syncthing
• Fedora 41 update for syncthing
• Fedora 40 update for syncthing
• Multiple vulnerabilities in IBM Cloud Pak System
• SUSE update for go1.22-openssl
• Multiple vulnerabilities in IBM Business Automation Insights
• Multiple vulnerabilities in OpenShift Data Foundation (formerly OpenShift Container Storage) 4.17
• SUSE update for go1.22-openssl
• Red Hat Enterprise Linux 9 update for podman
• Red Hat Enterprise Linux 9 update for grafana
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.4
• Ubuntu update for golang-1.17
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data update for Golang Go
• Fedora 42 update for doctl
• Ubuntu update for golang-1.18
• Multiple vulnerabilities in IBM Spectrum Protect Plus
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in IBM Concert Software
• Anolis OS update for go-toolset:an8 module
• Anolis OS update for golang
• Anolis OS update for grafana
• Anolis OS update for container-tools:an8 module
• Multiple vulnerabilities in Red Hat Ceph Storage 6
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Splunk Universal Forwarder update for third-party components
• Splunk Enterprise update for third-party components
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Multiple vulnerabilities in Red Hat Ceph Storage 8
• Fedora EPEL 9 update for rclone
• Fedora 42 update for gh