CVE-2021-27919: Medium severity golang vulnerability
Published Mar 11, 2021
·Updated
archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename.
Affected Software
3 affected components
Golang Go>=1.16.0<1.16.1
Fedoraproject Fedora=34
Fedoraproject Fedora=35
Event History
Mar 11, 2021
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-27919?
CVE-2021-27919 has a severity rating that allows attackers to cause a denial of service (panic) when using the Reader.Open API with malicious ZIP archives.
2
How do I fix CVE-2021-27919?
To fix CVE-2021-27919, update to Go version 1.16.1 or later.
3
What software versions are affected by CVE-2021-27919?
CVE-2021-27919 affects Go versions prior to 1.16.1, as well as Fedora releases 34 and 35.
4
What type of vulnerability is CVE-2021-27919?
CVE-2021-27919 is a denial of service vulnerability related to improper handling of ZIP archives.
5
Can CVE-2021-27919 be exploited remotely?
Yes, CVE-2021-27919 can be exploited remotely by using crafted ZIP files.