Stay Secure with the Latest Linux Advisories

security advisorygolangerror fix

Mageia 9: MGASA-2024-0217 moderate: golang zip handling issue

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. (CVE-2024-24789) . MGASA-2024-0217 - Updated golang packages fix security vulnerabilities Publication date: 14 Jun 2024 URL: https://advisories.mageia.org/MGASA-2024-0217.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-24789, CVE-2024-24790 The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors. (CVE-2024-24789) The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. (CVE-2024-24790) References: - https://bugs.mageia.org/show_bug.cgi?id=33269 - https://www.openwall.com/lists/oss-security/2024/06/04/1 - https://www.cve.org/CVERecord?id=CVE-2024-24789 - https://www.cve.org/CVERecord?id=CVE-2024-24790 SRPMS: - 9/core/golang-1.21.11-1.mga9 . Mageia's MGASA-2024-0218 addresses vulnerabilities in golang packages related to improper zip file management, enhancing overall security.. Golang Security, Mageia Updates, Zip File Handling. . LinuxSecurity.com Team

Jun 14, 2024 Mageia