archive/zip: Incorrect handling of certain ZIP files
CVE: CVE-2024-24789
Component: golang
CWE: CWE-20
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2024-06-04T00:00:00+00:00

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next valid one. This flaw allows a malicious user to access hidden information or files inside maliciously crafted ZIP files.


Remediation:
See the Red Hat OpenShift serverless 1 documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1
If you are using an earlier version of RHACS 4.4, you are advised to upgrade to this patch release 4.4.6.
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to this patch release 4.5.5.
If you are using an earlier version of RHACS, you are advised to upgrade to release 4.6.
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html
See the Red Hat OpenShift serverless 1.33 documentation at: 
https://access.redhat.com/documentation/en-us/red_hat_openshift_serverless/1.33
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Ensuring that the binaries for Helm are available for use to the customers/users. Follow the instructions linked in the References section to download the binaries for Helm and use them.
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/2789521

For supported configurations, refer to:

https://access.redhat.com/articles/1548993
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:793bac91943944692d72a61c47a3102edb70fb2948cdf54019f06376a87298ad

      (For s390x architecture)
      The image digest is sha256:925fb39b1c42a1b59aeb91cd3c12b4ca6f358459914809381fd6d7def577abdb

      (For ppc64le architecture)
      The image digest is sha256:a46a00e18fb14fe10a00bd87d579e0229b4aed46dd66b5f93d6e161164660d61

      (For aarch64 architecture)
      The image digest is sha256:9f20082482f4b82e3c39bfcd3eb7be7d0a1f5171cc22e6af42ae2df6ad1d74ad

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.17 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.17/release_notes/ocp-4-17-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:fbad931c725b2e5b937b295b58345334322bdabb0b67da1c800a53686d7397da

      (For s390x architecture)
      The image digest is sha256:9054f1987c9a0128374f2e7fa91a0b9d074d9665ef48758e6f29a89c14edd8f6

      (For ppc64le architecture)
      The image digest is sha256:8a457e302eb66d06d17cb5cba491077b92a623217e05d486740969974b2aaef8

      (For aarch64 architecture)
      The image digest is sha256:c9c31f9120f1049b88b282be4589d1da504ee436dfa51487349d08fecd29dd1e

All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.17/updating/updating_a_cluster/updating-cluster-cli.html
Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258