PT-2021-17669 · Go+2 · Go+2

Published 2021-03-11 · Updated 2024-06-15 · CVE-2021-27919

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Go versions 1.16.0 through 1.16.0

Description: The issue allows attackers to cause a denial of service (panic) when using the Reader.Open API for a ZIP archive containing a file with a path prefixed by "../". This can occur when parsing user-supplied archives, potentially serving as a denial of service vector. The "Reader.Open" API endpoint is affected when a ZIP archive contains a filename starting with "../", leading to a stack overflow and subsequent panic.

Recommendations: For Go versions 1.16.0 through 1.16.0, update to version 1.16.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the Reader.Open API for ZIP archives containing filenames prefixed with "../" until the update is applied. Restrict parsing of user-supplied archives to minimize the risk of exploitation.

Fix

Related Identifiers

ALT-PU-2021-1470

ALT-PU-2021-1482

ALT-PU-2021-1941

BIT-GOLANG-2021-27919

CVE-2021-27919

GO-2021-0067

OPENSUSE-SU-2024:10809-1

SUSE-SU-2021:0937-1

Affected Products

Alt Linux

Go

Suse

References · 33

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MU47VKTNXX33ZDLTI2ORRUY3KLJKU6G · Vendor Advisory
• https://security.gentoo.org/glsa/202208-02 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0937-1 · Vendor Advisory
• https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27919 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10809-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27919 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HM7U5JNS5WU66Q3S26PFIU2ITB2ATTQ4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-27919 · Security Note
• https://ubuntu.com/security/CVE-2021-27919 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27919 · Security Note
• https://osv.dev/vulnerability/GO-2021-0067 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-golang-2021-27919 · Vendor Advisory
• https://groups.google.com/g/golang-announce/c/MfiLYjG-RAw/m/zzhWj5jPAQAJ · Note
• https://suse.com/security/cve/CVE-2021-36221 · Note