CVE-2024-24789: Mishandling of corrupt central directory record in archive/zip

Modified

AliasesRHSA-2024:4867UBUNTU-CVE-2024-24789DEBIAN-CVE-2024-24789+1058 more

Published 05-06-2024Last modified 13-02-2025

Vulnerability summary

CVE-2024-24789 is a medium (CVSS 5.5) vulnerability in go standard library archive/zip. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 38.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 23 · Related 696

MGASA-2024-0217 OPENSUSE-SU-2024:14020-1 OPENSUSE-SU-2024:14023-1 RHEA-2025:0507 RHSA-2024:3722 RHSA-2024:4212+94 more

Showing 100 of 705.

Timeline

05-06-2024
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

CVSS metrics

8 scores · 8 sources · 1 version

v3.15.5

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.45% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard198 products

aactl< 0.4.12-r13
actions-runner-controller< 0.9.2-r1
actions-runner-controller-fips< 0.9.2-r2
addon-resizer< 1.8.21-r1
addon-resizer-fips< 1.8.21-r3

age< 1.1.1-r1
amass< 4.2.0-r11
argo-workflows< 3.6.5-r2
argo-workflows-fips< 3.5.7-r1
atlantis< 0.28.1-r1
atlantis-fips< 0.28.1-r1
aws-ebs-csi-driver< 1.31.0-r1
aws-efs-csi-driver-fips< 1.7.0-r11
aws-flb-cloudwatch< 1.9.4-r11
aws-flb-cloudwatch-fips< 1.9.4-r4
aws-flb-firehose< 1.7.2-r11
aws-flb-firehose-fips< 1.7.2-r4
aws-flb-kinesis< 1.10.2-r12
aws-flb-kinesis-fips< 1.10.2-r5
aws-load-balancer-controller< 2.8.1-r1
aws-load-balancer-controller-fips< 2.8.0-r1
azure-aad-pod-identity-mic< 1.8.17-r10
bank-vaults< 1.20.4-r14
bank-vaults-fips< 1.20.4-r11
bazelisk< 1.20.0-r1
bom< 0.6.0-r6
boring-registry< 0.14.0-r2
boring-registry-fips< 0.14.0-r4
buf< 1.32.2-r1
buildah< 1.36.0-r1
buildkitd< 0.13.2-r2
caddy< 2.8.4-r1
caddy-fips< 2.8.4-r1
cadvisor< 0.49.1-r8
cadvisor-fips< 0.49.1-r7
capslock< 0.2.2-r3
cass-operator< 1.21.0-r1
cass-operator-fips< 1.21.0-r1
cass-operator-fips-no-pvc-delete< 1.21.0-r1
cert-exporter< 2.12.0-r6
cert-exporter-fips< 2.12.0-r7
cert-manager-webhook-pdns< 2.5.1-r4
cert-manager-webhook-pdns-fips< 2.5.1-r5
certificate-transparency< 1.2.1-r1
certificate-transparency-fips< 1.2.1-r1
cfssl< 1.6.5-r5
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r1
chezmoi< 2.48.2-r1
cilium-1.15< 1.15.5-r1
cilium-cli< 0.16.9-r1
cilium-fips-1.15< 1.15.5-r2
cloud-sql-proxy-fips< 2.11.3-r1
cloudflared< 2024.1.0-r11
cluster-proportional-autoscaler< 1.8.11-r7
cni-plugins< 1.5.0-r1
cni-plugins-fips< 1.5.0-r1
configmap-reload< 0.13.0-r2
configmap-reload-fips< 0.12.0-r8
configmap-reload-fips-0.11< 0.11.1-r9
confluent-common-docker< 7.6.0-r6
conftest< 0.52.0-r3
conftest-fips< 0.52.0-r3
controller-gen< 0.15.0-r5
cortex< 1.17.1-r1
cortex-fips< 1.17.1-r3
cosign< 2.2.4-r5
cosign-fips< 2.2.4-r3
crane< 0.19.1-r6
cri-tools< 1.30.0-r3
croc< 10.0.7-r1
crossplane-provider-aws< 1.4.0-r3
crossplane-provider-azure< 1.1.0-r3
crossplane-provider-gcp< 1.1.0-r3
ctop< 0.7.7-r15
cue-fips< 0.8.2-r2
dagdotdev< 0.0.3-r1
dagger< 0.11.6-r1
dask-gateway< 2024.1.0-r5
dataplaneapi< 2.9.3-r1
dataplaneapi-fips< 2.9.3-r1
delve< 1.22.1-r5
dex< 2.40.0-r1
dex-fips< 2.40.0-r1
dex-k8s-authenticator< 1.4.0-r10
dgraph< 23.1.1-r2
direnv< 2.34.0-r4
dive< 0.12.0-r7
docker< 26.1.3-r1
docker-compose< 2.27.1-r1
docker-credential-acr-env< 0.7.0-r13
docker-credential-cgr< 0.2.59-r0
docker-credential-ecr-login< 0.8.0-r1
docker-credential-gcr< 2.1.22-r6
dockerize< 0.7.0-r9
dockerize-fips< 0.7.0-r9
doppler-kubernetes-operator< 1.5.1-r2
dynamic-localpv-provisioner< 4.0.0-r4
dynamic-localpv-provisioner-fips< 4.0.0-r5
envoy-ratelimit< 0.0_git20240220-r11
envoy-ratelimit-fips< 0.0_git20231206-r8
etcd-3.4< 3.4.32-r2
etcd-3.5< 3.5.14-r1
etcd-fips-3.4< 3.4.32-r2
etcd-fips-3.5< 3.5.13-r5
external-secrets-fips< 0.9.19-r1
extism< 1.5.0-r1
falcoctl< 0.8.0-r1
falcoctl-fips< 0.8.0-r1
falcoctl-fips-0.4< 0.4.0-r10
falcosidekick< 2.28.0-r7
falcosidekick-fips< 2.28.0-r9
ferretdb< 1.21.0-r4
flannel< 0.25.3-r1
flannel-cni-plugin< 1.4.1-r4
fluent-bit-plugin-loki< 3.0.0-r2
fluent-operator< 2.8.0-r1
fluent-operator-fips< 2.8.0-r1
flux< 2.3.0-r1
flux-helm-controller< 1.0.1-r2
flux-image-automation-controller< 0.38.0-r3
flux-image-reflector-controller< 0.32.0-r2
flux-kustomize-controller< 1.3.0-r3
flux-notification-controller< 1.3.0-r3
flux-source-controller< 1.3.0-r2
flyte< 1.12.0-r2
fq< 0.11.0-r5
frp< 0.58.1-r1
fulcio< 1.4.5-r3
fulcio-fips< 1.4.5-r4
fuse-overlayfs-snapshotter< 1.0.8-r10
gcsfuse< 1.4.2-r8
gh< 2.50.0-r1
ghaudit< 0.4.0-r4
git-lfs< 3.5.1-r6
git-lfs-fips< 3.5.1-r1
gitleaks< 8.18.3-r1
gitness< 3.0.0_beta6-r4
gitsign< 0.10.2-r2
gke-gcloud-auth-plugin< 0.0.2-r11
glab< 1.41.0-r1
go-1.20All versions (No fix recorded)
go-1.21< 1.21.11-r0
go-1.22< 1.22.4-r0
go-bindata< 3.1.3-r21
go-licenses< 1.6.0-r14
go-md2man< 2.0.4-r4
gobump< 0.7.7-r3
gobuster< 3.6.0-r12
golangci-lint< 1.59.0-r1
gomplate< 3.11.8-r1
gomplate-fips< 3.11.7-r1
gops< 0.3.28-r11
gostatsd< 28.3.0-r4
gosu< 1.17-r6
gosu-1.11< 1.11-r1
govulncheck< 1.0.2-r5
gpu-feature-discovery< 0.8.2-r1 | < 0.8.2-r2
grafana-agent-operator< 0.41.0-r1
grafana-mimir< 2.12.0-r1
grafana-operator< 5.9.2-r1
grafana-operator-fips< 5.9.2-r1
grpc-health-probe< 0.4.26-r3
grpc-health-probe-fips< 0.4.26-r1
grpcurl< 1.9.1-r4
grype< 0.78.0-r1
haproxy-ingress< 0.14.6-r8
harbor-2.9-portal-nginx-config< 2.9.4-r4
harbor-cli< 0.0.1-r3
harbor-registry< 3.0.0_alpha1-r4
harbor-registry-fips< 3.0.0_alpha1-r5
harbor-scanner-trivy< 0.31.2-r2
harbor-scanner-trivy-fips< 0.31.2-r2
hcloud< 1.43.1-r2
hello-world-golang< 1.3-r4
helm< 3.15.1-r1
helm-3< 3.19.2-r1
helm-4< 4.0.1-r1
helm-docs< 1.13.1-r1
helm-fips< 3.15.1-r2
helm-fips-3< 3.19.2-r0
helm-fips-4< 4.0.1-r1
helm-operator< 1.34.2-r1
helm-operator-fips< 1.34.2-r2
helm-push< 0.10.4-r11
hey< 0.1.4-r14
hivemind< 1.1.0-r1
http-echo< 1.0.0-r7
hubble-ui< 0.13.1-r1
hubble-ui-backend-fips< 0.13.1-r1
influx< 2.7.5-r2
ip-masq-agent< 2.9.3-r12
istio-pilot-agent-1.22< 1.22.0-r2
istio-pilot-discovery-1.22< 1.22.0-r2
jitsucom-bulker< 2.7.0-r1
jsonnet-bundler< 0.5.1-r5
k3d< 5.6.3-r3
k3s< 1.30.1-r1

Show all 198

Alpine2 products

forgejo< 7.0.4-r0
go≥ 1.22.0, < 1.22.4-r0

2 vendors · 200 products · Showing 200 of 860

References

29 links

go.dev/cl/585397REPORTWEBFIXPatch
go.dev/issue/66869REPORTWEBIssue TrackingPatch
groups.google.com/g/golang-announce/c/XbxouI9gY7k/m/TuoGEhxIEwAJREPORTWEBRelease Notes
pkg.go.dev/vuln/GO-2024-2888REPORTWEBThird Party Advisory
www.openwall.com/lists/oss-security/2024/06/04/1WEBMailing List
lists.fedoraproject.org/archives/…WEB
security.netapp.com/advisory/ntap-20250131-0008/Advisory
access.redhat.com/errata/RHSA-2024:4867Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1ARTICLE

Show all 29 references

bugzilla.redhat.com/show_bug.cgi?id=2292668REPORT
bugzilla.redhat.com/show_bug.cgi?id=2296266REPORT
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4867.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-24789REPORT
www.cve.org/CVERecord?id=CVE-2024-24789AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2024-24789AdvisoryOval
ubuntu.com/security/CVE-2024-24789REPORT
groups.google.com/g/golang-announce/c/XbxouI9gY7kREPORT
github.com/golang/go/issues/66869REPORT
github.com/golang/go/commit/c8e40338cf00f3c1d86c8fb23863ad67a4c72bccREPORT
github.com/golang/go/commit/cf501ac0c5fe351a8582d20b43562027927906e7REPORT
ubuntu.com/security/notices/USN-6886-1Advisory
ubuntu.com/security/notices/USN-7109-1Advisory
ubuntu.com/security/notices/USN-7111-1Advisory
security-tracker.debian.org/tracker/CVE-2024-24789Advisory
pkg.go.devWEB
github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24789.jsonAdvisory
www.suse.com/security/cve/CVE-2024-24789WEB
security.alpinelinux.org/vuln/CVE-2024-24789Advisory