CVE-2021-39293 log
| Source |
|
| Severity | Low |
| Remote | Yes |
| Type | Denial of service |
| Description | A security issue has been found in go before version 1.17.1. An oversight in the fix for CVE-2021-33196 still allows for an out of memory panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-2370 | go | 2:1.17-2 | 2:1.17.1-1 | Low | Fixed |
| References |
|---|
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw https://github.com/golang/go/issues/47801 https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35 |