CVE-2021-41772
Fixed in a distro release EPSS 3%
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
Products: golang go, fedoraproject fedora, oracle timesten_in-memory_database
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | stdlib | 1.16.10 |
| Go | stdlib | 1.17.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | delve | 1.7.2-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | go-toolset | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-bin | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-docs | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-misc | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-race | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-src | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| AlmaLinux 8 | golang-tests | 1.17.7-1.module_el8.6.0+2736+ec10aba8 |
| Amazon Linux 2 | golang | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-bin | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-docs | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-misc | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-race | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-shared | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-src | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2 | golang-tests | 1.16.15-1.amzn2.0.1 |
| Amazon Linux 2023 | golang | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-bin | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-docs | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-misc | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-race | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-shared | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-src | 1.19.3-2.amzn2023.0.2 |
| Amazon Linux 2023 | golang-tests | 1.19.3-2.amzn2023.0.2 |
| Arch Linux | go | 2:1.17.3-1 |
| Red Hat devtools 2021 | go-toolset-1.16 | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-build | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-bin | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-docs | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-misc | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-race | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-src | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-golang-tests | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-runtime | 0:1.16.12-1.el7_9 |
| Red Hat devtools 2021 | go-toolset-1.16-scldevel | 0:1.16.12-1.el7_9 |
| Red Hat Enterprise Linux 8 | delve | 0:1.7.2-1.module+el8.6.0+12972+ebab5911 |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.7.2-1.module+el8.6.0+12972+ebab5911 |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.7.2-1.module+el8.6.0+12972+ebab5911 |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-race | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.17.7-1.module+el8.6.0+14297+32a15e19 |
| Red Hat openshift 4.10 | coreos-installer | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-bootinfra-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debuginfo | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | coreos-installer-debugsource | 0:0.12.0-1.rhaos4.10.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.0-92.rhaos4.10.gitdaab4d1.el7 |
| Red Hat openshift 4.10 | cri-o-debuginfo | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | cri-o-debugsource | 0:1.23.1-9.rhaos4.10.gitbdffb9a.el8 |
| Red Hat openshift 4.10 | jenkins | 0:2.319.2.1643288987-1.el8 |
| Red Hat openshift 4.10 | jenkins-2-plugins | 0:4.10.1643404185-1.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-clients | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-clients-redistributable | 0:4.10.0-202202160023.p0.gf93da17.assembly.stream.el7 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el8 |
| Red Hat openshift 4.10 | openshift-hyperkube | 0:4.10.0-202202250816.p0.ge419edf.assembly.stream.el7 |
| Red Hat serverless 1.0 | openshift-serverless-clients | 0:1.1.0-2.el8 |
| Rocky Linux 8 | delve | 0:1.7.2-1.module+el8.6.0+824+8e984c20 |
| Rocky Linux 8 | go-toolset | 0:1.17.7-1.module+el8.6.0+824+8e984c20 |
| Rocky Linux 8 | golang | 0:1.17.7-1.module+el8.6.0+824+8e984c20 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.16 | 1.16.10-1.32.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP2 | go1.17 | 1.17.3-1.9.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.16 | 1.16.10-1.32.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP3 | go1.17 | 1.17.3-1.9.1 |
| Ubuntu 18.04 LTS | golang-1.8 | no fix |
| Ubuntu 22.04 LTS | golang-1.17 | no fix |
| Ubuntu Pro 18.04 LTS | golang-1.16 | no fix |
| Ubuntu Pro 20.04 LTS | golang-1.16 | no fix |
| openSUSE Leap 15.2 | go1.16 | 1.16.10-lp152.17.1 |
| openSUSE Leap 15.3 | go1.16 | 1.16.10-1.32.1 |
| openSUSE Leap 15.3 | go1.17 | 1.17.3-1.9.1 |
| openSUSE Tumbleweed | go1.16 | 1.16.10-1.1 |
| openSUSE Tumbleweed | go1.17 | 1.17.3-1.1 |