CVE-2021-27919: Denial of Service Vulnerability in golang
Summary
CVE-2021-27919: archive/zip in Go 1.16.x before 1.16.1 allows attackers to cause a denial of service (panic) upon attempted use of the Reader.Open API for a ZIP archive in which ../ occurs at the beginning of any filename. Affects golang versions >= 1.16.0, < 1.16.1. Fixed in 1.16.1. How to fix ↓
Also tracked for
- stdlib · Go
The same CVE-2021-27919 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang package is a popular open-source programming language that provides a robust development environment for building efficient and scalable applications. It offers a wide range of features and libraries that enable developers to create high-performance software. However, the package is susceptible to a denial of service vulnerability in the archive/zip module.
Vulnerability Detail
The vulnerability (CVE-2021-27919) in the golang package arises from a flaw in the Reader.Open API of the archive/zip module. When attempting to use this API with a ZIP archive containing filenames starting with "../", it triggers a panic, leading to a denial of service. This vulnerability can be exploited by malicious actors to disrupt the functionality of applications that utilize the affected golang package. The severity of this vulnerability is rated as Medium, according to the Common Vulnerability Scoring System (CVSS) version 3.1.
How To Fix
Minimum fixed version
1.16.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement input validation to ensure that filenames in ZIP archives do not start with "../". By checking and rejecting such filenames, the vulnerability can be mitigated. Here's an example code snippet in Go that demonstrates this workaround:
import (
"archive/zip"
"fmt"
"os"
)
func main() {
zipFile, err := zip.OpenReader("archive.zip")
if err != nil {
fmt.Println("Error opening ZIP archive: ", err)
return
}
defer zipFile.Close()
for _, file := range zipFile.File {
if file.Name[:3] == "../" {
fmt.Println("Invalid filename: ", file.Name)
continue
}
// Process the file
}
}
Conclusion
In conclusion, the golang package is vulnerable to a denial of service issue in the archive/zip module. This vulnerability can be mitigated by updating to version 1.16.1 or later. Additionally, developers can implement input validation as a temporary workaround. For further assistance and support in resolving this vulnerability, please contact DevNack.com.
See every vulnerability recorded for golang →
FAQ
The vulnerability allows attackers to cause a denial of service by triggering a panic in applications that use the affected golang package. This can lead to application crashes and disruption of service availability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and the tool will analyze it for any open-source vulnerabilities, including this one.
Yes, the fix for this vulnerability is available in version 1.16.1 of the golang package. It is recommended to update to this version or later to mitigate the risk.
Yes, developers can implement input validation to reject filenames in ZIP archives that start with "../". This can help mitigate the vulnerability until the package is updated.
The severity of this vulnerability is rated as Medium according to the Common Vulnerability Scoring System (CVSS) version 3.1.
Related vulnerabilities
Recent vulnerabilities recorded for golang.
