CVE-2024-24789
MediumSummary
A vulnerability in the archive/zip package of Go causes its handling of certain invalid zip files to differ from most zip implementations. This discrepancy can be exploited to create a zip file whose content varies depending on the reading implementation. The archive/zip package now rejects such files.
Risk Assessment
The organization may be exposed to attacks involving malicious zip files that are interpreted differently by various systems, potentially leading to security bypasses or unexpected application behavior.
Recommendation
It is recommended to update Go to a version containing the fix for CVE-2024-24789 and verify that applications using archive/zip do not process invalid zip files.
Original NVD description (English source)
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects fil