{"id":"CVE-2021-41772","aliases":["ALPINE-CVE-2021-41772","ALSA-2022:1819","AZL-6452","BELL-CVE-2021-41772","BIT-golang-2021-41772","EUVD-2021-28780","GHSA-8rv2-6fw3-rxjg","GO-2021-0264","MGASA-2021-0537","RHSA-2021:5176","RHSA-2022:0055","RHSA-2022:1745","RHSA-2022:1819","RLSA-2022:1819","SUSE-SU-2021:3833-1","SUSE-SU-2021:3834-1","UBUNTU-CVE-2021-41772","openSUSE-SU-2021:1539-1","openSUSE-SU-2021:3833-1","openSUSE-SU-2021:3834-1","openSUSE-SU-2024:11609-1","openSUSE-SU-2024:11610-1"],"status":"published","title":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted...","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.03253,"percentile":0.88506,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2021-11-08T00:00:00Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"go","fixed_in":["1.16.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"go","fixed_in":["1.17.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"golang","fixed_in":["1.17.8-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"golang","fixed_in":["1.16.10","1.17.3"],"sources":["osv"]},{"ecosystem":"Go","package":"stdlib","fixed_in":["1.16.10","1.17.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.16.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.7-1.module_el8.6.0+2736+ec10aba8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:2","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.8-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"golang","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.10"},{"introduced":"1.17.0"},{"fixed":"1.17.3"}]}]},{"source":"osv","ecosystem":"Go","package":"stdlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.10"},{"introduced":"1.17.0-0"},{"fixed":"1.17.3"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:devtools:2021","package":"go-toolset-1.16-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.12-1.el7_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.319.2.1643288987-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-bootinfra-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"coreos-installer-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12.0-1.rhaos4.10.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.1643404185-1.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.0-92.rhaos4.10.gitdaab4d1.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.23.1-9.rhaos4.10.gitbdffb9a.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:openshift:4.10::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"delve-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+12972+ebab5911"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-misc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-race","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"golang-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+14297+32a15e19"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"delve","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"golang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"go-toolset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.7-1.module+el8.6.0+824+8e984c20"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~18.04.2","1.16.2-0ubuntu1~18.04.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-2ubuntu1","1.8.3-2ubuntu1.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"golang-1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.2-0ubuntu1~20.04","1.16.2-0ubuntu1~20.04.1","1.16.2-0ubuntu1~20.04.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17-1ubuntu2","1.17.3-1ubuntu1","1.17.3-1ubuntu2","1.17.13-3ubuntu1","1.17.13-3ubuntu1.2","1.17.13-3ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-lp152.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.32.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.10-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"go1.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.3-1.1"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"golang","product":"go"},{"vendor":"oracle","product":"timesten_in-memory_database"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/0fM21h43arc","tags":["x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20211210-0003/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202208-02","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41772","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z/"},{"url":"https://github.com/advisories/GHSA-8rv2-6fw3-rxjg"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41772","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2022-1819.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-38297","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-39293","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-41771","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-41772","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23772","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23773","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2022-23806","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-41772","tags":["advisory"]},{"url":"https://go.dev/cl/349770","tags":["fix"]},{"url":"https://go.googlesource.com/go/+/b24687394b55a93449e2be4e6892ead58ea9a10f","tags":["fix"]},{"url":"https://go.dev/issue/48085","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2021-0537.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29717","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-December/009791.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DRORBGLIRSYNYTIE3EARJHAXYB2X5YQ3/","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5176","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_developer_tools/1/html/using_go_1.16.6_toolset","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2030806","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5176.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41772","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44716","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/hcmEScgc00k","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-44717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44717","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44717","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0055","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051730","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0055.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3577","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-20319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2011862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20319","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20319","tags":["advisory"]},{"url":"https://github.com/coreos/coreos-installer/security/advisories/GHSA-3r3g-g73x-g593","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21684","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21684","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21684","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2499","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020322","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21685","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2455","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21686","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21687","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21688","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21689","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21689","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21690","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21691","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21691","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020339","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020341","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21693","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020342","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21694","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21694","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21695","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21695","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21695","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21696","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2423","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21697","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2428","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-21698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020385","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21698","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2021-11-04/#SECURITY-2506","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41190","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41190","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41190","tags":["advisory"]},{"url":"https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42","tags":["article"]},{"url":"https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m","tags":["article"]},{"url":"https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0532","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0532","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0532","tags":["advisory"]},{"url":"https://github.com/cri-o/cri-o/security/advisories/GHSA-w2j5-3rcx-vx7x","tags":["article"]},{"url":"https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20612","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2558","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-20617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044502","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-20617","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-20617","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-1878","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1745","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2020725","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1745.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-41771","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-41771","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41771","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1819","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2006044","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2012887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2014704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053541","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1819.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38297","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-38297","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/AEBu9j7yj5A","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-39293","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39293","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39293","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/dx9d7IOseHw","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23772","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23773","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23773","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23806","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1819","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213833-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190649","tags":["report"]},{"url":"https://bugzilla.suse.com/1192377","tags":["report"]},{"url":"https://bugzilla.suse.com/1192378","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41772","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213834-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-41772","tags":["report"]},{"url":"https://github.com/golang/go/issues/48085","tags":["report"]},{"url":"https://github.com/golang/go/commit/b212ba68296b503b395e7d1838ca72a19030a6bf","tags":["report"]},{"url":"https://github.com/golang/go/commit/88407a8dd98411f1730907dc8a69b99488af0052","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PLB2XVI2D26YAVC7GRXSA47KJWR52UCR/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WHZ4EPZFI4C6TOOTOETZZVUOYMZB3YGR/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T00:00:00Z","modified":"2024-08-04T03:15:29.314Z","updated_at":"2026-11-02T14:32:59.105382Z"}],"euvd":[{"id":"EUVD-2021-28780","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T00:00:00Z","modified":"2024-08-04T03:15:29Z","updated_at":"2026-11-03T03:24:17.230256Z"}],"ghsa":[{"id":"GHSA-8rv2-6fw3-rxjg","title":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted...","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2022-05-24T19:20:03Z","modified":"2023-02-14T12:30:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:07.544087Z"}],"nvd":[{"id":"CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T06:15:08.107Z","modified":"2026-06-17T04:08:53.8Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:00.984108Z"}],"osv":[{"id":"ALPINE-CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T06:15:08.107Z","modified":"2026-11-03T06:32:58.687198959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"AZL-6452","title":"CVE-2021-41772 affecting package golang for versions less than 1.17.8-1","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T06:15:08Z","modified":"2026-04-21T04:32:26.57877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"BELL-CVE-2021-41772","title":"CVE-2021-41772 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:23.598466Z","modified":"2026-01-26T10:04:52.548296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T06:15:08.107Z","modified":"2026-10-24T10:30:43.9427914Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"RHSA-2021:5176","title":"Red Hat Security Advisory: go-toolset-1.16 and go-toolset-1.16-golang security and bug fix update","status":"published","published":"2024-09-30T14:18:24Z","modified":"2026-08-20T10:02:34Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0055","title":"Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update","status":"published","published":"2024-09-30T14:19:01Z","modified":"2026-08-20T10:02:39Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:1745","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.22.0","status":"published","published":"2024-09-18T04:47:35Z","modified":"2026-10-13T10:03:00Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:1819","title":"Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update","status":"published","published":"2024-10-21T18:05:15Z","modified":"2026-10-16T10:01:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1819","title":"Moderate: go-toolset:rhel8 security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: Command-line arguments may overwrite global data (CVE-2021-38297)\n\n* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)\n\n* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)\n\n* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)\n\n* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)\n\n* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)\n\n* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:29:31Z","modified":"2026-02-05T15:15:08.338595Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2021-11-08T06:15:00Z","modified":"2025-10-24T04:50:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"ALSA-2022:1819","title":"Moderate: go-toolset:rhel8 security and bug fix update","description":"Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. \n\nSecurity Fix(es):\n\n* golang: Command-line arguments may overwrite global data (CVE-2021-38297)\n\n* golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196) (CVE-2021-39293)\n\n* golang: debug/macho: invalid dynamic symbol table command can cause panic (CVE-2021-41771)\n\n* golang: archive/zip: Reader.Open panics on empty string (CVE-2021-41772)\n\n* golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString (CVE-2022-23772)\n\n* golang: cmd/go: misinterpretation of branch names can lead to incorrect access control (CVE-2022-23773)\n\n* golang: crypto/elliptic IsOnCurve returns true for invalid field elements (CVE-2022-23806)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:29:31Z","modified":"2026-10-29T11:01:15.87334149Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BIT-golang-2021-41772","description":"Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.","status":"published","published":"2024-03-06T11:03:41.271Z","modified":"2026-10-16T09:45:16.378806366Z","updated_at":"2026-11-02T15:28:30.70064Z"},{"id":"GO-2021-0264","title":"Panic when opening certain archives in archive/zip","description":"Previously, opening a zip with (*Reader).Open could result in a panic if the zip contained a file whose name was exclusively made up of slash characters or \"..\" path elements.\n\nOpen could also panic if passed the empty string directly as an argument.\n\nNow, any files in the zip whose name could not be made valid for fs.FS.Open will be skipped, and no longer added to the fs.FS file list, although they are still accessible through (*Reader).File.\n\nNote that it was already the case that a file could be accessible from (*Reader).Open with a name different from the one in (*Reader).File, as the former is the cleaned name, while the latter is the original one.\n\nFinally, the actual panic site was made robust as a defense-in-depth measure.","status":"published","published":"2022-01-13T20:54:43Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2021-0537","title":"Updated golang packages fix security vulnerability","description":"ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10\nand 1.17.x before 1.17.3 Accesses a Memory Location After the End of a\nBuffer, aka an out-of-bounds slice situation. (CVE-2021-41771)\n  \n\nGo before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip\nReader.Open panic via a crafted ZIP archive containing an invalid name or\nan empty filename field. (CVE-2021-41772)\n","status":"published","published":"2021-12-03T18:45:31Z","modified":"2026-04-16T04:44:27.218359249Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1539-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-12-06T13:06:42Z","modified":"2026-02-04T02:16:41.567066Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3833-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nSecurity update go1.17.3 (released 2021-11-04) (bsc#1190649).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:04:58Z","modified":"2026-02-04T04:06:56.067426Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3834-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:05:22Z","modified":"2026-02-04T03:59:40.997879Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11609-1","title":"go1.16-1.16.10-1.1 on GA media","description":"These are all security issues fixed in the go1.16-1.16.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:14.81693Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:11610-1","title":"go1.17-1.17.3-1.1 on GA media","description":"These are all security issues fixed in the go1.17-1.17.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:31.559447Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3833-1","title":"Security update for go1.17","description":"This update for go1.17 fixes the following issues:\n\nSecurity update go1.17.3 (released 2021-11-04) (bsc#1190649).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:04:57Z","modified":"2026-02-04T03:07:17.493402Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3834-1","title":"Security update for go1.16","description":"This update for go1.16 fixes the following issues:\n\nSecurity update go1.16.10 (released 2021-11-04) (bsc#1182345).\n\n- CVE-2021-41771: Fixed invalid dynamic symbol table command that could have caused panic (bsc#1192377).\n- CVE-2021-41772: Fixed panic on (*Reader).Open (bsc#1192378).\n","status":"published","published":"2021-12-01T15:05:21Z","modified":"2026-02-04T02:54:43.601825Z","updated_at":"2026-11-02T15:53:49.605187Z"}]}}