Skip to content
Fencer Intel
medium 5.3

CVE-2024-24789 json

Mishandling of corrupt central directory record in archive/zip

published 2y ago modified 2mo ago also BIT-golang-2024-24789 , EUVD-2024-22166 , GO-2024-2888

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Patch / fix

  • bitnami golang 1.21.11, 1.22.4
  • go stdlib 1.21.11, 1.22.4
  • Go standard library archive/zip 1.21.11, 1.22.4
  • golang go 1.21.11, 1.22.4
  • golang-1.17 Ubuntu 22.04 LTS 1.17.13-3ubuntu1.3
  • golang-1.18 Ubuntu 20.04 LTS 1.18.1-1ubuntu1~20.04.3
  • golang-1.18 Ubuntu 22.04 LTS 1.18.1-1ubuntu1.2
  • golang-1.21 Ubuntu 20.04 LTS 1.21.1-1~ubuntu20.04.3
  • golang-1.21 Ubuntu 22.04 LTS 1.21.1-1~ubuntu22.04.3
  • golang-1.21 Ubuntu 24.04 LTS 1.21.9-1ubuntu0.1
  • golang-1.22 Ubuntu 20.04 LTS 1.22.2-2~20.04.1
  • golang-1.22 Ubuntu 22.04 LTS 1.22.2-2~22.04.1

ubuntu advisories UBUNTU-CVE-2024-24789

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • helm ocp tools 4.17 3.15.4-60.el9
  • helm-redistributable ocp tools 4.17 3.15.4-60.el9
  • grafana RHEL 9 10.2.6-4.el9
  • grafana-selinux RHEL 9 10.2.6-4.el9
  • podman RHEL 9 2:5.2.2-1.el9
  • podman-tests RHEL 9 2:5.2.2-1.el9
  • podman-docker RHEL 9 2:5.2.2-1.el9
  • podman-remote RHEL 9 2:5.2.2-1.el9

red hat advisories RHEA-2025:0507RHSA-2024:9115RHSA-2024:9102RHSA-2024:5258RHSA-2024:4237RHSA-2024:5291

  • go1.22-openssl SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.22.7.1-150600.13.3.1
  • go1.22-openssl SLE Module for Development Tools 15 SP5, openSUSE Leap 15.5 1.22.7.1-150000.1.3.1
  • go1.21-openssl SLE Module for Development Tools 15 SP6, openSUSE Leap 15.6 1.21.13.1-150600.16.3.1
  • container-suseconnect SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +10 more 2.5.0-150000.4.55.1
  • go1.21-openssl SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE Module for Development Tools 15 SP5 +3 more 1.21.13.1-150000.1.11.1
  • go1.22 SLE Module for Development Tools 15 SP6, SLE Module for Development Tools 15 SP5, openSUSE Leap 15.6 +1 more 1.22.4-150000.1.18.1
  • go1.21 SLE Module for Development Tools 15 SP6, SLE Module for Development Tools 15 SP5, openSUSE Leap 15.6 +1 more 1.21.11-150000.1.36.1
  • go1.21 SLE Software Development Kit 12 SP5 1.21.11-1.36.1

suse advisories SUSE-SU-2024:3938-1SUSE-SU-2024:3772-1SUSE-SU-2024:3755-1SUSE-SU-2024:3360-1SUSE-SU-2024:3089-1SUSE-SU-2024:1970-1

  • forgejo openSUSE Tumbleweed 7.0.4-1.1
  • go1.22 openSUSE Tumbleweed 1.22.4-1.1
  • go1.21 openSUSE Tumbleweed 1.21.11-1.1

opensuse advisories openSUSE-SU-2024:14050-1openSUSE-SU-2024:14020-1openSUSE-SU-2024:14023-1

  • grafana AlmaLinux 9 10.2.6-4.el9
  • grafana-selinux AlmaLinux 9 10.2.6-4.el9
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
  • crit AlmaLinux 8 3.18-5.module_el8.10.0+3858+6ad51f9f
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3876+e55593a8
  • criu AlmaLinux 8 3.18-5.module_el8.10.0+3845+87b84552
  • crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3858+6ad51f9f
  • crun AlmaLinux 8 1.14.3-2.module_el8.10.0+3876+e55593a8

almalinux advisories ALSA-2024:9115ALSA-2024:5258ALSA-2024:5291ALSA-2024:4212ALSA-2024:4237

  • go-toolset Rocky Linux 8 1.21.11-1.module+el8.10.0+1831+fc70fba6
  • delve Rocky Linux 8 1.21.2-3.module+el8.10.0+1814+f68f8a63
  • golang Rocky Linux 8 1.21.11-1.module+el8.10.0+1831+fc70fba6
  • grafana Rocky Linux 8 9.2.10-17.el8_10
  • podman Rocky Linux 9 4:5.2.2-13.el9_5
  • criu Rocky Linux 8 3.18-5.module+el8.10.0+1815+5fe7415e
  • crun Rocky Linux 8 1.14.3-2.module+el8.10.0+1815+5fe7415e
  • runc Rocky Linux 8 1:1.1.12-4.module+el8.10.0+1843+6892ab28

rocky linux advisories RLSA-2024:4237RLSA-2024:5291RLSA-2024:9102RLSA-2024:5258RLSA-2024:4212

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.22.4-r0
  • forgejo Alpine 3.24, Alpine 3.23, Alpine 3.22 +1 more 7.0.4-r0

alpine advisories ALPINE-CVE-2024-24789

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • golang CBL-Mariner 2.0 1.21.11-1
  • golang CBL-Mariner 2.0 1.18.8-8
  • msft-golang CBL-Mariner 2.0 1.22.4-1
  • golang Azure Linux 3.0 1.22.3-1

azure linux advisories AZL-42389AZL-42412AZL-42415AZL-52663

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2024-24789 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-24789 updated cvss 5.5

golang: archive/zip: Incorrect handling of certain ZIP files

  • Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Migration Toolkit for Applications 7 mta/mta-analyzer-lsp-rhel9 Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator, workload-availability/node-maintenance-must-gather-rhel8 Red Hat OpenShift Developer Tools and Services odo Red Hat OpenShift Service Mesh 2 openshift-service-mesh/prometheus-rhel8 Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-db-rhel8, +2 more
    +1 more products
    Red Hat Ansible Automation Platform 1.2 openshift-clients
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Connectivity Link 1 openshift4/rhcl-operator Red Hat OpenShift AI (RHOAI) odh-model-controller-container
    affected: workaround, no fix available
  • Red Hat OpenShift Container Platform 4 podman, podman-tests, podman-docker, podman-remote, podman-gvproxy, podman-plugins, +16 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Data Science (RHODS) rhods/odh-modelmesh-serving-controller-rhel8 Red Hat OpenShift Dev Spaces devspaces/udi-rhel8, devspaces/traefik-rhel8, devspaces/devspaces-rhel8-operator
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-argocd-rhel9-container, openshift-gitops-1/gitops-operator-bundle
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 openshift-golang-builder-container Red Hat Quay 3 quay/clair-rhel8, quay/quay-builder-rhel8
    affected: workaround, no fix available
  • Red Hat Storage 3 golang, golang-bin, golang-src, golang-misc, golang-tests
    affected: workaround, no fix planned “Out of support scope”
show 19 more
  • Red Hat NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9 v1.6.0-70, network-observability/network-observability-operator-bundle 1.6.0-88, network-observability/network-observability-rhel9-operator v1.6.0-70, network-observability/network-observability-ebpf-agent-rhel9 v1.6.0-70, network-observability/network-observability-console-plugin-rhel9 v1.6.0-70, network-observability/network-observability-flowlogs-pipeline-rhel9 v1.6.0-70
    fixed: vendor fix RHSA-2024:4785
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.3-8, oadp/oadp-rhel9-operator 1.3.3-12, oadp/oadp-mustgather-rhel9 1.3.3-20, oadp/oadp-velero-restic-restore-helper-rhel9 1.3.3-8
    fixed: vendor fix RHSA-2024:4982
  • Red Hat OpenShift Developer Tools and Services for OCP 4.17 helm 3.15.4-60.el9, helm-redistributable 3.15.4-60.el9
    fixed: vendor fix RHEA-2025:0507
  • Red Hat Ceph Storage 6.1 Tools rhceph/rhceph-6-rhel9 6-356, rhceph/rhceph-6-dashboard-rhel9 6-112, rhceph/rhceph-promtail-rhel9 v2.4.0-40, rhceph/keepalived-rhel9 2.2.8-1745816949, rhceph/snmp-notifier-rhel9 1.2.1-1745816915, rhceph/rhceph-haproxy-rhel9 2.4.22-1745816965
    fixed: vendor fix RHSA-2025:4240
  • Red Hat Ceph Storage 8.1 Tools rhceph/rhceph-8-rhel9 8-492, rhceph/grafana-rhel9 11.5.2-6, rhceph/keepalived-rhel9 2.2.8-65, rhceph/oauth2-proxy-rhel9 v7.6.0-27, rhceph/snmp-notifier-rhel9 1.2.1-115, rhceph/rhceph-haproxy-rhel9 2.4.22-67, +1 more
    fixed: vendor fix RHSA-2025:9776
  • Red Hat Enterprise Linux AppStream (v. 8) grafana 9.2.10-17.el8_10, grafana-selinux 9.2.10-17.el8_10, crit 3.18-5.module+el8.10.0+22202+761b9a65, criu 3.18-5.module+el8.10.0+22202+761b9a65, crun 1.14.3-2.module+el8.10.0+22202+761b9a65, runc 1.1.12-4.module+el8.10.0+22202+761b9a65, +36 more
    fixed: vendor fix RHSA-2024:5258
  • Red Hat Enterprise Linux AppStream (v. 9) podman 5.2.2-1.el9, grafana 10.2.6-4.el9, golang 1.21.11-1.el9_4, podman-tests 5.2.2-1.el9, podman-docker 5.2.2-1.el9, podman-remote 5.2.2-1.el9, +7 more
    fixed: vendor fix RHSA-2024:4212
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-openshift-apiserver-rhel9 v4.16.0-202408262007.p0.g6b51841.assembly.stream.el9
    fixed: vendor fix RHSA-2024:6004
  • Red Hat OpenShift Container Platform 4.17 openshift 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el8, openshift 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el9, openshift-clients 4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el8, openshift-clients 4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el9, openshift-hyperkube 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el8, openshift-hyperkube 4.17.0-202409121706.p0.gd3adea4.assembly.stream.el9, +180 more
    fixed: vendor fix RHSA-2024:3722
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 devspaces 3.23-1756504388
    fixed: vendor fix RHSA-2025:15847
  • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients 1.12.0-10.el8
    fixed: vendor fix RHSA-2024:4867
  • Red Hat OpenShift Serverless 1.33 openshift-serverless-1/client-kn-rhel8 1.12.0-6, openshift-serverless-1/func-utils-rhel8 1.33.1-1, openshift-serverless-1/serving-queue-rhel8 1.12.0-5, openshift-serverless-1/eventing-mtping-rhel8 1.12.0-7, openshift-serverless-1/kourier-control-rhel8 1.12.0-5, openshift-serverless-1/serving-webhook-rhel8 1.12.0-5, +30 more
    fixed: vendor fix RHSA-2024:4872
  • Red Hat RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.4.6-2, advanced-cluster-security/rhacs-roxctl-rhel8 4.4.6-2, advanced-cluster-security/rhacs-scanner-rhel8 4.4.6-2, advanced-cluster-security/rhacs-rhel8-operator 4.4.6-2, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.4.6-2, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.4.6-2
    fixed: vendor fix RHSA-2024:9583
  • Red Hat RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.5.5-3, advanced-cluster-security/rhacs-roxctl-rhel8 4.5.5-4, advanced-cluster-security/rhacs-scanner-rhel8 4.5.5-4, advanced-cluster-security/rhacs-rhel8-operator 4.5.5-4, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.5.5-4, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.5.5-4
    fixed: vendor fix RHSA-2024:10186
  • Red Hat RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8 4.6.0-6, advanced-cluster-security/rhacs-roxctl-rhel8 4.6.0-2, advanced-cluster-security/rhacs-scanner-rhel8 4.6.0-4, advanced-cluster-security/rhacs-rhel8-operator 4.6.0-2, advanced-cluster-security/rhacs-scanner-v4-rhel8 4.6.0-5, advanced-cluster-security/rhacs-scanner-slim-rhel8 4.6.0-4
    fixed: vendor fix RHSA-2024:10775
  • Red Hat RHODF 4.16 for RHEL 9 odf4/odr-rhel9-operator v4.16.2-2
    fixed: vendor fix RHSA-2024:6755
  • Red Hat RHODF 4.17 for RHEL 9 odf4/rook-ceph-rhel9-operator v4.17.0-51
    fixed: vendor fix RHSA-2024:8676
  • Red Hat RHOSSM 2.6 for RHEL 8 openshift-service-mesh/kiali-rhel8 1.73.9-2, openshift-service-mesh/pilot-rhel8 2.6.0-19, openshift-service-mesh/grafana-rhel8 2.6.0-7, openshift-service-mesh/ratelimit-rhel8 2.6.0-8, openshift-service-mesh/istio-cni-rhel8 2.6.0-21, openshift-service-mesh/kiali-ossmc-rhel8 1.73.10-3, +3 more Red Hat RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9 2.6.0-18
    fixed: vendor fix RHSA-2024:5094
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Ironic content for Red Hat OpenShift Container Platform 4.17 pysnmp 4.4.12-6.el9, python-ddt 1.6.0-1.el9, python-amqp 5.0.6-1.el9, python-smi 0.3.4-10.el9, python-vine 5.0.0-3.el9, python-zipp 0.5.1-3.el9, +314 more Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel8, multicluster-engine/agent-service-rhel8, multicluster-engine/hypershift-cli-rhel9, multicluster-engine/hypershift-rhel8-operator, multicluster-engine/cluster-api-provider-azure-rhel9
    not affected: vulnerable code not present

17 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2y ago

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CNA 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
OSV 3.1 5.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
bitnami golang
<1.21.11
>=1.22.0-0, <1.22.4
1.21.11
1.22.4
go stdlib
<1.21.11
>=1.22.0-0, <1.22.4
1.21.11
1.22.4

Affected products

  • Go standard library archive/zip
  • golang go

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.