HIGH7.5

GO-2021-0240

Panic when reading certain archives in archive/zip

Quick fix

GO-2021-0240 — stdlib: upgrade to the fixed version with the command below.

go get stdlib@v1.15.13

Details

NewReader and OpenReader can cause a panic or an unrecoverable fatal error when reading an archive that claims to contain a large number of files, regardless of its actual size.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/stdlib

Introduced in: 0Fixed in: 1.15.13

Fixgo get stdlib@v1.15.13

References

https://go.dev/cl/318909[FIX]
https://go.googlesource.com/go/+/74242baa4136c7a9132a8ccd9881354442788c8c[FIX]
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI[WEB]
https://go.dev/issue/46242[REPORT]