Read the docs
TI-2024-16306 Aliases CVE-2024-24789GHSA-236w-p7wf-5ph8

Mishandling of corrupt central directory record in archive/zip

Priority MEDIUM 58Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 19 fixed, 18 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00443 38th percentileScored 2026-11-07
Fix Partial archive/zip (Go standard library): 1.21.11, 1.22.4Red Hat: 22 advisoriesRed Hat: 19 fixed, 18 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Go standard libraryarchive/zipbefore 1.21.11; 1.22.0-0 to before 1.22.41.21.11, 1.22.4Patch availableCNA
  • archive/zip VendorGo standard library Affected before 1.21.11; 1.22.0-0 to before 1.22.4 Fixed in 1.21.11, 1.22.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*before 1.21.11; 1.22.0 to before 1.22.4VulnerableGo standard library
  • cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Versions before 1.21.11; 1.22.0 to before 1.22.4 Vulnerable ·Go standard library

Remediation

  • Fix · CNA archive/zip (Go standard library) Fixed in 1.21.11, 1.22.4

Red Hat 22 advisories

  • RHSA-2025:15847 Released 2025-09-15 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.23.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/machineexec-rhel9 +3
  • RHSA-2025:9776 Released 2025-06-26 · Red Hat rating Important
    New RHCS 8.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9, rhceph/keepalived-rhel9, rhceph/oauth2-proxy-rhel9 +4
  • RHSA-2025:4240 Released 2025-04-28 · Red Hat rating Important
    Updated 6.1 container image is now available in the Red Hat Ecosystem Catalog.
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
Show 19 more Red Hat advisories
  • RHSA-2024:10775 Released 2024-12-04 · Red Hat rating Moderate
    ACS 4.6 enhancement and security update
    • RHACS 4.6 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:10186 Released 2024-11-22 · Red Hat rating Important
    ACS 4.5 enhancement update
    • RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:9583 Released 2024-11-13 · Red Hat rating Important
    ACS 4.4 enhancement update
    • RHACS 4.4 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
  • RHSA-2024:9115 Released 2024-11-12 · Red Hat rating Moderate
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 9) grafana-10.2.6-4.el9, grafana-selinux-10.2.6-4.el9
  • RHSA-2024:9102 Released 2024-11-12 · Red Hat rating Moderate
    podman security update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:5.2.2-1.el9, podman-docker-2:5.2.2-1.el9, podman-plugins-2:5.2.2-1.el9 +2
  • RHSA-2024:8676 Released 2024-10-30 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
    • RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
  • RHSA-2024:3718 Released 2024-10-01 · Red Hat rating Moderate
    OpenShift Container Platform 4.17.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:3722 Released 2024-10-01 · Red Hat rating Moderate
    OpenShift Container Platform 4.17.0 packages and security update
    • Red Hat OpenShift Container Platform 4.17 openshift-4.17.0-202409121706.p0.gd3adea4.assembly.stream.el8, openshift-4.17.0-202409121706.p0.gd3adea4.assembly.stream.el9, openshift-clients-4.17.0-202409111134.p0.gbc58b3a.assembly.stream.el8 +21
  • RHSA-2024:6755 Released 2024-09-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.2 security and bug fix update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9 +7
  • RHSA-2024:6004 Released 2024-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.16.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-cluster-baremetal-operator-rhel9, openshift4/ose-csi-driver-manila-rhel9, openshift4/ose-hypershift-rhel9 +2
  • RHSA-2024:5291 Released 2024-08-13 · Red Hat rating Moderate
    grafana security update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-17.el8_10, grafana-selinux-9.2.10-17.el8_10
  • RHSA-2024:5258 Released 2024-08-13 · Red Hat rating Important
    container-tools:rhel8 security update
    • Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
  • RHSA-2024:5094 Released 2024-08-07 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh Containers for 2.6.0 security update
    • RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
    • RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
  • RHSA-2024:4785 Released 2024-08-07 · Red Hat rating Moderate
    Network Observability 1.6.1 for OpenShift
    • NETOBSERV 1.6 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
  • RHSA-2024:4982 Released 2024-08-01 · Red Hat rating Important
    OpenShift API for Data Protection (OADP) 1.3.3 security and bug fix update
    • 9Base-OADP-1.3 oadp/oadp-mustgather-rhel9, oadp/oadp-rhel9-operator, oadp/oadp-velero-restic-restore-helper-rhel9 +1
  • RHSA-2024:4872 Released 2024-07-25 · Red Hat rating Moderate
    Release of OpenShift Serverless 1.33.1 security update
    • Red Hat OpenShift Serverless 1.33 openshift-serverless-1-tech-preview/backstage-plugins-eventmesh-rhel8, openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8, openshift-serverless-1/client-kn-rhel8 +33
  • RHSA-2024:4867 Released 2024-07-25 · Red Hat rating Moderate
    Release of openshift-serverless-clients kn 1.33.1 security update and bug fixes
    • Red Hat OpenShift Serverless 1.0 openshift-serverless-clients-1.12.0-10.el8
  • RHSA-2024:4237 Released 2024-07-02 · Red Hat rating Moderate
    go-toolset security update
    • Red Hat Enterprise Linux AppStream (v. 8) delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.aarch64::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.ppc64le::go-toolset:rhel8, delve-1.21.2-3.module+el8.10.0+21244+5b2d9000.src::go-toolset:rhel8 +19
  • RHSA-2024:4212 Released 2024-07-02 · Red Hat rating Moderate
    golang security update
    • Red Hat Enterprise Linux AppStream (v. 9) go-toolset-1.21.11-1.el9_4, golang-1.21.11-1.el9_4, golang-bin-1.21.11-1.el9_4 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix planned: Will not fix
Migration Toolkit for Applications 7AffectedNo fix planned: Will not fix
Node Maintenance OperatorAffectedNo fix planned: Will not fix
OpenShift Developer Tools and ServicesAffectedNo fix planned: Will not fix
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 3AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift Virtualization 4AffectedNo fix yet
Red Hat Quay 3AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Out of support scope
9Base-OADP-1.3Fixed RHSA-2024:4982
NETOBSERV 1.6 for RHEL 9Fixed RHSA-2024:4785
OpenShift Developer Tools and Services for OCP 4.17Fixed—
RHACS 4.4 for RHEL 8Fixed RHSA-2024:9583
RHACS 4.5 for RHEL 8Fixed RHSA-2024:10186
RHACS 4.6 for RHEL 8Fixed RHSA-2024:10775
RHODF 4.16 for RHEL 9Fixed RHSA-2024:6755
RHODF 4.17 for RHEL 9Fixed RHSA-2024:8676
RHOSSM 2.6 for RHEL 8Fixed RHSA-2024:5094
RHOSSM 2.6 for RHEL 9Fixed RHSA-2024:5094
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2025:4240
Red Hat Ceph Storage 8.1 ToolsFixed RHSA-2025:9776
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:4237, RHSA-2024:5258, RHSA-2024:5291
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:4212, RHSA-2024:9102, RHSA-2024:9115
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:6004
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2024:3718, RHSA-2024:3722
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23Fixed RHSA-2025:15847
Red Hat OpenShift Serverless 1.0Fixed RHSA-2024:4867
Red Hat OpenShift Serverless 1.33Fixed RHSA-2024:4872
Not affected: 20 products
  • 9Base-OADP-1.3
  • Ironic content for Red Hat OpenShift Container Platform 4.17
  • Multicluster Engine for Kubernetes
  • Node Maintenance Operator
  • OpenShift Service Mesh 2
  • RHACS 4.4 for RHEL 8
  • RHACS 4.5 for RHEL 8
  • RHACS 4.6 for RHEL 8
  • RHODF 4.16 for RHEL 9
  • RHODF 4.17 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4
  • Red Hat Enterprise Linux 10
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.23
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24789
  2. 2026-10-03 Alias added: GHSA-236w-p7wf-5ph8

References

Patch 2

Advisory 1

Other 3

  • TI-2020-00578 Improper certificate validation in Microsoft Windows KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2018-05208 The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used… CVSS 3.1HIGH 8.8
  • TI-2018-12083 Improper input validation in [UNKNOWN] golang CVSS 3.1HIGH 8.1
  • TI-2021-15910 Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a… CVSS 3.1CRITICAL 9.8
  • TI-2017-11040 Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. CVSS 3.1CRITICAL 9.8
See all 170 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences