CVE-2021-41772: Vulnerability in stdlib package - Panic when opening certain archives in archive/zip

Background

The stdlib package in Go is a collection of standard libraries that provide fundamental functionality for Go programs. It includes various modules for tasks such as file handling, networking, and data manipulation. One of the modules, archive/zip, allows for the creation and extraction of zip archives. However, a vulnerability has been discovered in the package that can lead to a panic when opening certain archives.

Vulnerability Detail

The vulnerability arises when attempting to open a zip archive using the (*Reader).Open function. If the archive contains a file with a name consisting solely of slash characters or ".." path elements, it could trigger a panic. Additionally, passing an empty string as an argument to the function could also result in a panic. The issue has been addressed in versions 1.16.10 and 1.17.3 of the stdlib package, where files with invalid names are skipped and not added to the file list. However, they can still be accessed through the (*Reader).File function. It's important to note that the cleaned name returned by (*Reader).Open may differ from the original name in (*Reader).File. The panic site has also been made more robust as a defense-in-depth measure.

go get stdlib@vgo1.25.5

Workaround

If updating the stdlib package is not immediately feasible, a workaround can be implemented by manually skipping files with invalid names when processing zip archives. Here is an example of how this can be done:

package main

import (
	"archive/zip"
	"fmt"
	"io"
	"os"
)

func main() {
	zipFile, err := zip.OpenReader("example.zip")
	if err != nil {
		fmt.Println("Failed to open zip file: ", err)
		return
	}
	defer zipFile.Close()

	for _, file := range zipFile.File {
		if file.Name == "" || file.Name[0] == '/' || file.Name[0] == '.' {
			fmt.Println("Skipping file with invalid name: ", file.Name)
			continue
		}

		// Process the valid file
		// ...
	}
}

Conclusion

In conclusion, the stdlib package in Go is vulnerable to a panic when opening certain archives in the archive/zip module. This can be triggered by files with invalid names or passing an empty string as an argument. The issue has been addressed in versions 1.16.10 and 1.17.3 of the package. It is recommended to update the package to the patched versions or implement the provided workaround. Regularly checking for vulnerabilities using tools like Vulert can help ensure the security of your applications.

See every vulnerability recorded for stdlib →

FAQ