search

mockingbot / react-native-zip-archive

Zip archive utility for react-native
MIT License
420 stars 154 forks source link

Uncaught Exception in zip4j #270

Closed Udbhav12 closed 1 year ago

Udbhav12 commented 1 year ago

Describe the bug As per https://github.com/mockingbot/react-native-zip-archive/blob/v6.0.8/android/build.gradle#L40
 react-native-zip-archive is currently using 2.6.4 version of zip4j. There is a security issue which has been patched in 2.10.0 version of zip4j Refer to below link for more details https://github.com/advisories/GHSA-q62h-jw38-24vh

To Reproduce NA

Expected behavior No security vulnerability

Env (please complete the following information): Package Version: - 6.0.8

Additional context Below is the CVE ID https://nvd.nist.gov/vuln/detail/CVE-2022-24615

plrthink commented 1 year ago

Thanks for notifying the issue, I would upgrade it in the next release.

plrthink commented 1 year ago

You can try 6.0.9-beta.0 to test your needs. Any feedback is appreciated.

plrthink commented 1 year ago

Just published the fix in 6.0.9.