@FiloSottile requested issue #48085 to be considered for backport to the next 1.16 minor release.
Thank you for reporting this to security@golang.org. Invalid input should not cause programs to panic, if the input could be attacker controlled. If this required a call to Open("") to trigger, it could have been borderline, since it's hard for an attacker to control the argument to Open. However, the reproducer in #48085 (comment) triggers a panic with a real file name.
package main
import "archive/zip"
func main() {
reader, err := zip.OpenReader("liquibase-core-4.4.3-sources.zip")
if err != nil {
panic(err)
}
reader.Open("META-INF/MANIFEST.MF")
}
We'll backport this as a security fix in the PUBLIC track. @gopherbot, please open backport issues.
@FiloSottile requested issue #48085 to be considered for backport to the next 1.16 minor release.