-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis is based on the information from the Go vulnerability database (pkg.go.dev/vuln/GO-2024-2888) and the related GitHub issue (go.dev/issue/66869). These sources explicitly name NewReader and OpenReader as the affected functions within the archive/zip package. The vulnerability stems from how these functions parse the End of Central Directory Record (EOCDR), particularly its comment length, which can be crafted to cause the Go archive/zip package to interpret the ZIP file differently than other implementations. The patch involves rejecting files with such errors, indicating that the vulnerability lies in the parsing logic within these functions.
KEV Misses 88% of Exploited CVEs- Get the report