A security issue has been found in go before version 1.17.1. An oversight in the fix for CVE-2021-33196 still allows for an out of memory panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable.
A security issue has been found in go before version 1.17.1. An oversight in the fix for CVE-2021-33196 still allows for an out of memory panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable.
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw https://github.com/golang/go/issues/47801 https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35
Vulmon