CVE-2024-24789

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next valid one. This flaw allows a malicious user to access hidden information or files inside maliciously crafted ZIP files.

Moderate impact: this issue affects Red Hat products and Community Projects that ship components using Go's archive/zip library, with affected records across Community Projects, Red Hat OpenShift AI, Core, Hybrid Cloud, and Portfolio products. A local attacker with low privileges can cause software using the library to process a maliciously crafted ZIP with a corrupted central-directory record; the library may skip the invalid record and process a later valid one, so different ZIP implementations can expose or process different contents, including hidden information or files. Red Hat's CVSS is 5.5 (Moderate), matching NIST's score; CISA also rates it Moderate at 5.3. Some current product records are marked not affected because their assessed components are outside the affected component scope; the record does not provide a more specific technical rationale for those exclusions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

For affected products, apply vendor-provided updates when available. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.