CVE-2021-39293 — Allocation of Resources Without Limits or Throttling in GO

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-400 — Uncontrolled Resource Consumption7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 88.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Golang GO
Timeline
PublishedJan 24
Latest updateMay 18

Description

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic. NOTE: this issue exists because of an incomplete fix for CVE-2021-33196.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDgolang/go1.17.0 — 1.17.1+1

🔴Vulnerability Details

4
OSV
Panic due to crafted inputs in archive/zip↗2022-05-18
▶
GHSA
GHSA-j532-8pqq-78jr: In archive/zip in Go before 1↗2022-01-25
▶
OSV
CVE-2021-39293: In archive/zip in Go before 1↗2022-01-24
▶
CVEList
CVE-2021-39293: In archive/zip in Go before 1↗2022-01-24
▶

📋Vendor Advisories

2
Red Hat
golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)↗2021-08-18
▶
Debian
CVE-2021-39293: golang-1.15 - In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive h...↗2021
▶
CVE-2021-39293 — Golang GO vulnerability | cvebase