CVE-2024-24789

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The Go Programming Language.

Security Fix(es):

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.(CVE-2024-24789)

The Go Programming Language.

Security Fix(es):

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.(CVE-2024-24789)

The Go Programming Language.

Security Fix(es):

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.(CVE-2024-24789)

.

Security Fix(es):

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.(CVE-2024-24789)

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The golang packages provide the Go programming language compiler.

Security Fix(es):

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang.

Security Fix(es):

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
• containers/image: digest type does not guarantee valid type (CVE-2024-3727)
• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

• CVE-2024-24789: fix zip parsing to reject EOCDR records with truncated comments
• CVE-2024-9355: fix HMAC to pass initialized length to EVP_DigestSignFinal, ensuring correct output handling.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. (CVE-2024-24789) The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. (CVE-2024-24790)

These are all security issues fixed in the go1.22-1.22.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the go1.21-1.21.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the forgejo-7.0.4-1.1 package on the GA media of openSUSE Tumbleweed.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

• containers/image: digest type does not guarantee valid type (CVE-2024-3727)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

• gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: Symlink error leads to information disclosure (CVE-2022-4122)

• containers/image: digest type does not guarantee valid type (CVE-2024-3727)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

This update for go1.22 fixes the following issues:

go1.21.11 release (bsc#1212475).

• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973).
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (bsc#1225974).

This update for go1.21 fixes the following issues:

go1.21.11 release (bsc#1212475).

• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973).
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (bsc#1225974).

This update for go1.21 fixes the following issues:

go1.21.11 release (bsc#1212475).

• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973).
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (bsc#1225974).

This update for go1.22 fixes the following issues:

go1.21.11 release (bsc#1212475).

• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973).
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (bsc#1225974).

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for container-suseconnect rebuilds it against current go1.21.13.1.

Security issues fixed: CVE-2024-24789, CVE-2024-24790, CVE-2024-24791

This update for go1.21-openssl fixes the following issues:

• CVE-2024-24791: Fixed denial of service due to improper 100-continue handling (bsc#1227314)
• CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip (bsc#1225973)
• CVE-2024-24790: Fixed unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip (bsc#1225974)
• CVE-2024-24787: Fixed arbitrary code execution during build on darwin in cmd/go (bsc#1224017)
• CVE-2023-45288: Fixed denial of service due to close connections when receiving too many headers in net/http and x/net/http2 (bsc#1221400)
• CVE-2023-45289: Fixed incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http and net/http/cookiejar (bsc#1221000)
• CVE-2023-45290: Fixed memory exhaustion in Request.ParseMultipartForm in net/http (bsc#1221001)
• CVE-2024-24783: Fixed denial of service on certificates with an unknown public key algorithm in crypto/x509 (bsc#1220999)
• CVE-2024-24784: Fixed comments in display names are incorrectly handled in net/mail (bsc#1221002)
• CVE-2024-24785: Fixed errors returned from MarshalJSON methods may break template escaping in html/template (bsc#1221003)

Other fixes:

• Update to version 1.21.13.1 cut from the go1.21-fips-release (jsc#SLE-18320)
• Update to version 1.21.13 (bsc#1212475)
• Remove subpackage go1.x-openssl-libstd for compiled shared object libstd.so. (jsc#PED-1962)
• Ensure VERSION file is present in GOROOT as required by go tool dist and go tool distpack (bsc#1219988)

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…

This update for go1.22-openssl fixes the following issues:

This update ships go1.22-openssl 1.22.7.1 (jsc#SLE-18320)

• Update to version 1.22.7.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.7-1-openssl-fips.

  • Update to Go 1.22.7 (#229)

• go1.22.7 (released 2024-09-05) includes security fixes to the encoding/gob, go/build/constraint, and go/parser packages, as well as bug fixes to the fix command and the runtime.

  CVE-2024-34155 CVE-2024-34156 CVE-2024-34158:

  • go#69142 go#69138 bsc#1230252 security: fix CVE-2024-34155 go/parser: stack exhaustion in all Parse* functions (CVE-2024-34155)
  • go#69144 go#69139 bsc#1230253 security: fix CVE-2024-34156 encoding/gob: stack exhaustion in Decoder.Decode (CVE-2024-34156)
  • go#69148 go#69141 bsc#1230254 security: fix CVE-2024-34158 go/build/constraint: stack exhaustion in Parse (CVE-2024-34158)
  • go#68811 os: TestChtimes failures
  • go#68825 cmd/fix: fails to run on modules whose go directive value is in '1.n.m' format introduced in Go 1.21.0
  • go#68972 cmd/cgo: aix c-archive corrupting stack

• go1.22.6 (released 2024-08-06) includes fixes to the go command, the compiler, the linker, the trace command, the covdata command, and the bytes, go/types, and os/exec packages.

  • go#68594 cmd/compile: internal compiler error with zero-size types
  • go#68546 cmd/trace/v2: pprof profiles always empty
  • go#68492 cmd/covdata: too many open files due to defer f.Close() in for loop
  • go#68475 bytes: IndexByte can return -4294967295 when memory usage is above 2^31 on js/wasm
  • go#68370 go/types: assertion failure in recent range statement checking logic
  • go#68331 os/exec: modifications to Path ignored when *Cmd is created using Command with an absolute path on Windows
  • go#68230 cmd/compile: inconsistent integer arithmetic result on Go 1.22+arm64 with/without -race
  • go#68222 cmd/go: list with -export and -covermode=atomic fails to build
  • go#68198 cmd/link: issues with Xcode 16 beta

• Update to version 1.22.5.3 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-3-openssl-fips.

  • Only load openssl if fips == '1' Avoid loading openssl whenever GOLANG_FIPS is not 1. Previously only an unset variable would cause the library load to be skipped, but users may also expect to be able to set eg. GOLANG_FIPS=0 in environments without openssl.

• Update to version 1.22.5.2 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-2-openssl-fips.

  • Only load OpenSSL when in FIPS mode

• Update to version 1.22.5.1 cut from the go1.22-fips-release branch at the revision tagged go1.22.5-1-openssl-fips.

  • Update to go1.22.5

• go1.22.5 (released 2024-07-02) includes security fixes to the net/http package, as well as bug fixes to the compiler, cgo, the go command, the linker, the runtime, and the crypto/tls, go/types, net, net/http, and os/exec packages.

  CVE-2024-24791:

  • go#68200 go#67555 bsc#1227314 security: fix CVE CVE-2024-24791 net/http: expect: 100-continue handling is broken in various ways
  • go#65983 cmd/compile: hash of unhashable type
  • go#65994 crypto/tls: segfault when calling tlsrsakex.IncNonDefault()
  • go#66598 os/exec: calling Cmd.Start after setting Cmd.Path manually to absolute path without '.exe' no longer implicitly adds '.exe' in Go 1.22
  • go#67298 runtime: 'fatal: morestack on g0' on amd64 after upgrade to Go 1.21, stale bounds
  • go#67715 cmd/cgo/internal/swig,cmd/go,x/build: swig cgo tests incompatible with C++ toolchain on builders
  • go#67798 cmd/compile: internal compiler error: unexpected type: <nil> (<nil>) in for-range
  • go#67820 cmd/compile: package-level variable initialization with constant dependencies doesn't match order specified in Go spec
  • go#67850 go/internal/gccgoimporter: go building failing with gcc 14.1.0
  • go#67934 net: go DNS resolver fails to connect to local DNS server
  • go#67945 cmd/link: using -fuzz…