CVE-2021-41772

golang: archive/zip: Reader.Open panics on empty string

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.

Go versiones anteriores a 1.16.10 y 1.17.x versiones anteriores a 1.17.3, permite un pánico de archivo/zip Reader.Open por medio de un archivo ZIP diseñado que contiene un nombre no válido o un campo filename vacío

A vulnerability was found in archive/zip of the Go standard library. Applications written in Go where Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can panic when parsing a crafted ZIP archive containing completely invalid names or an empty filename argument.

An update that solves two vulnerabilities and has one errata is now available. This update for go1.16 fixes the following issues. Security update go1.16.10. Fixed invalid dynamic symbol table command that could have caused panic. Fixed panic on .Open. This update was imported from the SUSE:SLE-15:Update update project.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-09-28 CVE Reserved
2021-11-08 CVE Published
2024-08-04 CVE Updated
2025-05-28 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation
CWE-125: Out-of-bounds Read

CAPEC

References (9)

URL	Tag	Source
https://cert-portal.siemens.com/productcert/pdf/ssa-744259.pdf
https://security.netapp.com/advisory/ntap-20211210-0003	Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.html	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://groups.google.com/g/golang-announce/c/0fM21h43arc	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OFS3M3OFB24SWPTIAPARKGPUMQVUY6Z	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON7BQRRJZBOR5TJHURBAB3WLF4YXFC6Z	2023-11-07
https://security.gentoo.org/glsa/202208-02	2023-11-07
https://access.redhat.com/security/cve/CVE-2021-41772	2022-05-10
https://bugzilla.redhat.com/show_bug.cgi?id=2020736	2022-05-10

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				< 1.16.10 Search vendor "Golang" for product "Go" and version " < 1.16.10"		-		Affected
Golang Search vendor "Golang"		Go Search vendor "Golang" for product "Go"				>= 1.17.0 < 1.17.3 Search vendor "Golang" for product "Go" and version " >= 1.17.0 < 1.17.3"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				34 Search vendor "Fedoraproject" for product "Fedora" and version "34"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				35 Search vendor "Fedoraproject" for product "Fedora" and version "35"		-		Affected
Oracle Search vendor "Oracle"		Timesten In-memory Database Search vendor "Oracle" for product "Timesten In-memory Database"				-		-		Affected