| Severity |
|
| Remote |
|
| Type |
| - |
Unknown |
| + |
Denial of service |
|
| Description |
| + |
A security issue has been found in go before version 1.17.1. An oversight in the fix for CVE-2021-33196 still allows for an out of memory panic when the indicated directory size in the archive header is so large that subtracting it from the archive size overflows a uint64, effectively bypassing the check that the number of files in the archive is reasonable. |
|
| References |
| + |
https://groups.google.com/g/golang-announce/c/dx9d7IOseHw |
| + |
https://github.com/golang/go/issues/47801 |
| + |
https://github.com/golang/go/commit/1dd24caf08985066b309af6bc461780c73e05c35 |
|
| Notes |
|