search

capacitor-community / sqlite

Community plugin for native & electron SQLite databases
MIT License
426 stars 104 forks source link

ZIPFoundation vulnerability #511

Closed dstuff closed 3 weeks ago

dstuff commented 3 months ago

Hi!

We are using Black Duck software to check our Ionic app and got alert regarding an issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file (more info here). As a recommendation it says that we should update ZIPFoundation package to ZIPFoundation 0.9.17

Will you plan to update it in the future?

jepiqueau commented 3 months ago

@dstuff ZIPFoundation 0.9.17 or 0.9.18 are not available on CocoaPods see ZIPFoundation #300 so there is nothing i can do till they fix it. Sorry for this. Put pressure on them, this is a known issue since October 2023

jepiqueau commented 3 weeks ago

@dstuff in version 5.7.3-1 of the plugin ZIPFoundation has been upgraded to 0.9.18