← All advisories

Medium severity5.9NVD Advisory· Published Jan 10, 2023· Updated Jun 17, 2026

CVE-2023-22899

CVE-2023-22899

Description

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
net.lingala.zip4j:zip4jMaven	< 2.11.3	2.11.3

Affected products

3

Zip4j Project/Zip4j
cpe:2.3:a:zip4j_project:zip4j:*:*:*:*:*:*:*:*
Range: <=2.11.2
Zip4j/Zip4jcpe-rescue
ghsa-coords
pkg:maven/net.lingala.zip4j/zip4j
Range: < 2.11.3

Patches

Vulnerability mechanics

References

9

breakingthe3ma.app/files/Threema-PST22.pdfnvdExploitTechnical DescriptionThird Party AdvisoryWEB
github.com/srikanth-lingala/zip4j/issues/485nvdExploitIssue TrackingPatchThird Party AdvisoryWEB
breakingthe3ma.appnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-2pj2-gchf-wmw7ghsaADVISORY
github.com/srikanth-lingala/zip4j/releasesnvdRelease NotesThird Party AdvisoryWEB
news.ycombinator.com/itemnvdThird Party AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2023-22899ghsaADVISORY
threema.ch/en/blog/posts/news-alleged-weaknesses-statementnvdVendor AdvisoryWEB
github.com/srikanth-lingala/zip4j/releases/tag/v2.11.3ghsaWEB

News mentions

0

No linked articles in our index yet.