Maven package
net.lingala.zip4j/zip4j
pkg:maven/net.lingala.zip4j/zip4j
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-22899 | — | < 2.11.3 | 2.11.3 | Jan 10, 2023 | Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. | ||
| CVE-2022-24615 | — | < 2.10.0 | 2.10.0 | Feb 24, 2022 | zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library. | ||
| CVE-2018-1002202 | Med | 6.5 | < 1.3.3 | 1.3.3 | Jul 25, 2018 | zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'. |
- CVE-2023-22899Jan 10, 2023affected < 2.11.3fixed 2.11.3
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
- CVE-2022-24615Feb 24, 2022affected < 2.10.0fixed 2.10.0
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
- affected < 1.3.3fixed 1.3.3
zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.