Detections
Analytics

Alpine: multiple go packages: security update to 1.22.4-r0

critical Tenable Cloud Security Plugin ID 426010

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most
 zip implementations. This misalignment could be exploited to create an zip file with contents that vary
 depending on the implementation reading the file. The archive/zip package now rejects files containing
 these errors. (CVE-2024-24789)

 - The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6
 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
 (CVE-2024-24790)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-24789

https://security.alpinelinux.org/vuln/CVE-2024-24790

Plugin Details

Severity: Critical

ID: 426010

Version: Revision 1.19

Type: Local

Published: 5/16/2025

Updated: 6/16/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.86

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-24790

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/4/2024

Reference Information

CVE: CVE-2024-24789, CVE-2024-24790

IAVB: 2024-B-0071-S