CVE-2021-33196: Input Validation
A vulnerability was found in archive/zip of the Go standard library. Applications written in Go can panic or potentially exhaust system memory when parsing malformed ZIP files.
Other sources
Due to a pre-allocation optimization in zip.NewReader, a malformed archive which indicates it has a significant number of files can cause either a panic or memory exhaustion.
References:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912 https://github.com/golang/go/issues/46242
— Red Hat
Golang Go is vulnerable to a denial of service, caused by a flaw in the NewReader and OpenReader functions in archive/zip. By persuading a victim to open a specially-crafted archive file, a remote attacker could exploit this vulnerability to cause a panic or an unrecoverable fatal error, and results in a denial of service condition.
— IBM
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5 a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
— Microsoft
In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReader panic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.22.0-3.el8 - Upgrade
Upgrade
redhat/openshift-serverless-clientsto a version that resolves this vulnerability.Fixed in 0:0.23.2-1.el8 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.15-0:1.15.13-1.el7_9 - Upgrade
Upgrade
redhat/go-toolsetto a version that resolves this vulnerability.Fixed in 1.15-golang-0:1.15.13-1.el7_9 - Upgrade
Upgrade
redhat/cri-oto a version that resolves this vulnerability.Fixed in 0:1.21.2-8.rhaos4.8.git8d4264e.el8 - Upgrade
Upgrade
redhat/openshift-clientsto a version that resolves this vulnerability.Fixed in 0:4.8.0-202107292313.p0.git.1077b05.assembly.stream.el8 - Upgrade
Upgrade
redhat/openshiftto a version that resolves this vulnerability.Fixed in 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.17.0 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.16.5 - Upgrade
Upgrade
redhat/goto a version that resolves this vulnerability.Fixed in 1.15.13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.16.2-2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-33196?
CVE-2021-33196 is a vulnerability in the archive/zip package in Go before version 1.15.13 and 1.16.x before version 1.16.5.
How does the vulnerability in the archive/zip package in Go work?
The vulnerability in the archive/zip package in Go can be exploited by persuading a victim to open a specially-crafted archive file, causing a panic or unrecoverable fatal error.
What is the severity of CVE-2021-33196?
CVE-2021-33196 has a severity rating of 7.5 (high).
How do I fix the vulnerability in the archive/zip package in Go?
To fix the vulnerability, update your version of Go to at least version 1.17.0, 1.16.5, or 1.15.13, depending on your current version.
Where can I find more information about CVE-2021-33196?
You can find more information about CVE-2021-33196 in the following references: [Link 1](https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33912), [Link 2](https://github.com/golang/go/issues/46242), [Link 3](https://golang.org/cl/322949).