packages:
  - module: std
    package: archive/zip
    symbols:
      - NewReader
      - OpenReader
    versions:
      - fixed: 1.16.8
      - introduced: 1.17
        fixed: 1.17.1
description: |
     The NewReader and OpenReader functions in archive/zip can cause a panic or
     an unrecoverable fatal error when reading an archive that claims to contain
     a large number of files, regardless of its actual size. This is
     caused by an incomplete fix for CVE-2021-33196.
cves:
  - CVE-2021-39293
credit: OSS-Fuzz Project and Emmanuel Odeke
links:
    pr: https://go.dev/cl/343434
    commit: https://go.googlesource.com/go/+/bacbc33439b124ffd7392c91a5f5d96eca8c0c0b
    context:
      - https://go.dev/issue/47801
      - https://groups.google.com/g/golang-announce/c/dx9d7IOseHw