Skip to content

archive/zip: can panic when calling Reader.Open #44916

Closed

Description

@katiehockman

The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with “../”.

This issue is CVE-2021-27919.

Activity

  1. added this to the Go1.17 milestone on Mar 10, 2021
  2. gopherbot commented on Mar 10, 2021

    @gopherbot
    Contributor

    Change https://golang.org/cl/300489 mentions this issue: archive/zip: fix panic in Reader.Open

  3. added a commit that references this issue on Mar 19, 2021
    d21be68
  4. locked and limited conversation to collaborators on Mar 10, 2022
  5. added a commit that references this issue on Apr 29, 2024
    cd3b4ca
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions