CVE-2024-24789: 
Go vulnerability analysis and mitigation

The archive/zip package in Go versions prior to 1.21.11 and from 1.22.0 before 1.22.4 contains a vulnerability in handling certain types of invalid zip files. The vulnerability was discovered by Yufan You (@ouuan) and was assigned CVE-2024-24789. The issue was publicly disclosed on June 4, 2024, when Go versions 1.22.4 and 1.21.11 were released with fixes (Golang Announce).

The vulnerability stems from the archive/zip package's handling of corrupt central directory records, where its behavior differs from most other ZIP implementations. The issue specifically relates to how the package processes EOCDR (End of Central Directory Record) with bogus comment length fields. Instead of rejecting invalid files, the package would skip EOCDR with bogus comment length and continue searching for the next one (Go Issue).

This misalignment in implementation behavior could be exploited to create ZIP files with contents that vary depending on the implementation reading the file. The vulnerability has been assigned a CVSS score of 5.5 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating potential for data integrity impacts (Ubuntu CVE).

The vulnerability can be exploited by creating specially crafted ZIP files that take advantage of the implementation differences. A proof of concept has been demonstrated where the same ZIP file could reveal different contents when processed by different implementations, potentially hiding malicious content from security tools while making it accessible to the vulnerable Go implementation (Go Issue).

The vulnerability has been fixed in Go versions 1.21.11 and 1.22.4. The fix involves modifying the archive/zip package to reject files containing these errors instead of attempting to process them. Users are advised to upgrade to these patched versions (Golang Announce).