golang-1.16: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion

Debian Bug report logs - #989492
golang-1.16: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: golang-1.16: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion

Date: Sat, 05 Jun 2021 10:08:50 +0200

Source: golang-1.16
Version: 1.16.4-1
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://github.com/golang/go/issues/46397
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for golang-1.16.

CVE-2021-33196[0]:
| archive/zip: malformed archive may cause panic or memory exhaustion

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-33196
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33196
[1] https://github.com/golang/go/issues/46397

Regards,
Salvatore

Message #10 received at 989492@bugs.debian.org (full text, mbox, reply):

From: Shengjing Zhu <zhsj@debian.org>

To: Salvatore Bonaccorso <carnil@debian.org>, 989492@bugs.debian.org

Subject: Re: Bug#989492: golang-1.16: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion

Date: Sat, 5 Jun 2021 19:17:44 +0800

Hi Salvatore,

On Sat, Jun 5, 2021 at 4:12 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
> Hi,
>
> The following vulnerability was published for golang-1.16.
>
> CVE-2021-33196[0]:

How does security-tracker pull the cve data? The point release from
golang appears addressing 4 cve, which are CVE-2021-3319{5,6,7,8}. Why
is the security-tracker only aware of CVE-2021-33196?

https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI

-- 
Shengjing Zhu

Message #15 received at 989492-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 989492-close@bugs.debian.org

Subject: Bug#989492: fixed in golang-1.16 1.16.5-1

Date: Sat, 05 Jun 2021 11:33:34 +0000

Source: golang-1.16
Source-Version: 1.16.5-1
Done: Shengjing Zhu <zhsj@debian.org>

We believe that the bug you reported is fixed in the latest version of
golang-1.16, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 989492@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Shengjing Zhu <zhsj@debian.org> (supplier of updated golang-1.16 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Sat, 05 Jun 2021 19:03:59 +0800
Source: golang-1.16
Architecture: source
Version: 1.16.5-1
Distribution: unstable
Urgency: medium
Maintainer: Go Compiler Team <team+go-compiler@tracker.debian.org>
Changed-By: Shengjing Zhu <zhsj@debian.org>
Closes: 989492
Changes:
 golang-1.16 (1.16.5-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 1.16.5
     + CVE-2021-33195: net: Lookup functions may return invalid host names
     + CVE-2021-33196: archive/zip: malformed archive may cause panic or memory
       exhaustion (Closes: #989492)
     + CVE-2021-33197: net/http/httputil: ReverseProxy forwards Connection
       headers if first one is empty
     + CVE-2021-33198: math/big: (*Rat).SetString with "1.770p02041010010011001001"
       crashes with "makeslice: len out of range"
Checksums-Sha1:
 5d335ce05b7c1f4def0c5d04558fec8c2b1bbec3 1992 golang-1.16_1.16.5-1.dsc
 b3d00525ea5af180149fafca8da730c6f988f29f 20921372 golang-1.16_1.16.5.orig.tar.gz
 306ac2691d7bc3aefd40939fdca7f9820837baee 39792 golang-1.16_1.16.5-1.debian.tar.xz
 a94208702801b2e7baddebf6555b777ac84e5bdf 6059 golang-1.16_1.16.5-1_amd64.buildinfo
Checksums-Sha256:
 cd9ca8bd10a64f338cd950f39661fec6b7a6e98e6859f1ed1cf43b6cb7b13c91 1992 golang-1.16_1.16.5-1.dsc
 7bfa7e5908c7cc9e75da5ddf3066d7cbcf3fd9fa51945851325eebc17f50ba80 20921372 golang-1.16_1.16.5.orig.tar.gz
 ef7521fec00ee4a9fae6fe4ff55bb4964d3e5c6f66c11c433aed22cd2d742dea 39792 golang-1.16_1.16.5-1.debian.tar.xz
 82744196c29bee7586f40c2c3ed761d62a385c025dc0874626ab6d16d4661020 6059 golang-1.16_1.16.5-1_amd64.buildinfo
Files:
 6300a4b0e3f8a0d644dfdb244a5709e0 1992 golang optional golang-1.16_1.16.5-1.dsc
 f3c06704e536dcca1814b16dbcdc4a36 20921372 golang optional golang-1.16_1.16.5.orig.tar.gz
 5cda9bd119b714ad50039d850c416120 39792 golang optional golang-1.16_1.16.5-1.debian.tar.xz
 67b728457614ddb1c4188e0c2363afec 6059 golang optional golang-1.16_1.16.5-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iIYEARYIAC4WIQSRhdT1d2eu7mxV1B5/RPol6lUUywUCYLte3BAcemhzakBkZWJp
YW4ub3JnAAoJEH9E+iXqVRTLFF0BAJ+m42aiD60ahtLzi0Z2Ec+ACNeARlHlCDfH
YIcADs5yAQC7mUyMXd41VzeJ0Nj9E2cBXlAZ+21UCCuQNkuVKtBNDw==
=6rsV
-----END PGP SIGNATURE-----

Message #20 received at 989492@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Shengjing Zhu <zhsj@debian.org>, 989492@bugs.debian.org

Subject: Re: Bug#989492: golang-1.16: CVE-2021-33196: archive/zip: malformed archive may cause panic or memory exhaustion

Date: Sat, 5 Jun 2021 13:40:47 +0200

Hi,

On Sat, Jun 05, 2021 at 07:17:44PM +0800, Shengjing Zhu wrote:
> Hi Salvatore,
> 
> On Sat, Jun 5, 2021 at 4:12 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
> > Hi,
> >
> > The following vulnerability was published for golang-1.16.
> >
> > CVE-2021-33196[0]:
> 
> How does security-tracker pull the cve data? The point release from
> golang appears addressing 4 cve, which are CVE-2021-3319{5,6,7,8}. Why
> is the security-tracker only aware of CVE-2021-33196?
> 
> https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI

When it pulls various feeds, and then someone of the team investigates
the new entries.

I will look at those others shortly.

Regards,
Salvatore

Send a report that this bug log contains spam.