data/reports/GO-2022-0273.yaml

modules:
  - module: std
    versions:
      - fixed: 1.16.8
      - introduced: 1.17.0
        fixed: 1.17.1
    vulnerable_at: 1.17.0
    packages:
      - package: archive/zip
        symbols:
          - NewReader
          - OpenReader
        skip_fix: 'TODO: revisit this reason (fix appears to not work with Go <1.18)'
description: |
    The NewReader and OpenReader functions in archive/zip can cause a panic or
    an unrecoverable fatal error when reading an archive that claims to contain
    a large number of files, regardless of its actual size. This is
    caused by an incomplete fix for CVE-2021-33196.
published: 2022-05-18T18:23:31Z
cves:
  - CVE-2021-39293
credit: OSS-Fuzz Project and Emmanuel Odeke
references:
  - fix: https://go.dev/cl/343434
  - fix: https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b
  - report: https://go.dev/issue/47801
  - web: https://groups.google.com/g/golang-announce/c/dx9d7IOseHw