GO-2024-2888 | Vulnetix

GO-2024-2888 PUBLISHED

Record from OSV · Published June 4, 2024

Mishandling of corrupt central directory record in archive/zip

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
nri-nginx	Chainguard	3.4.6-r1
newrelic-infra-operator	Wolfi	0.18.1-r1
aws-load-balancer-controller	Wolfi	2.8.1-r1
certificate-transparency-fips	Chainguard	1.2.1-r1
fluent-operator	Wolfi	2.8.0-r1
tkn	Wolfi	0.37.0-r1
dask-gateway	Wolfi	2024.1.0-r5
up	Wolfi	0.30.0-r1
trillian	Chainguard	1.6.0-r7
kube-rbac-proxy-fips	Chainguard	0.17.1-r3
aws-flb-firehose-fips	Chainguard	1.7.2-r4
kafka-proxy	Wolfi	0.3.10-r1

88 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
chainguard	nri-nginx	0
wolfi	newrelic-infra-operator	0
wolfi	aws-load-balancer-controller	0
chainguard	certificate-transparency-fips	0
wolfi	fluent-operator	0
wolfi	tkn	0
wolfi	dask-gateway	0
wolfi	up	0
chainguard	trillian	0
chainguard	kube-rbac-proxy-fips	0
chainguard	aws-flb-firehose-fips	0
wolfi	kafka-proxy	0
chainguard	karpenter-0.35	0
wolfi	tekton-chains	0
chainguard	stern	0
chainguard	litestream	0
chainguard	restic	0
wolfi	ytt	0
chainguard	kafka-proxy	0
wolfi	velero-plugin-for-aws	0

…and 821 more

The same record, from the CLI:

vulnetix vdb vuln GO-2024-2888
vulnetix vdb fixes GO-2024-2888

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2024-2888/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart