Open mend-for-github-com[bot] opened 4 months ago
Zip4j - A Java library for zip files and streams
Library home page: https://github.com/srikanth-lingala/zip4j
Path to dependency file: /nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184332/zip4j-2.8.0.jar
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Dependency Hierarchy: - :x: **zip4j-2.8.0.jar** (Vulnerable Library)
Found in base branch: main
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
Publish Date: 2023-01-10
URL: CVE-2023-22899
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-2pj2-gchf-wmw7
Release Date: 2023-01-10
Fix Resolution: 2.11.3
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
Publish Date: 2022-02-24
URL: CVE-2022-24615
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24615
Release Date: 2022-02-24
Fix Resolution: 2.10.0
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
Zip4j - A Java library for zip files and streams
Library home page: https://github.com/srikanth-lingala/zip4j
Path to dependency file: /nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184332/zip4j-2.8.0.jar
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-22899
### Vulnerable Library - zip4j-2.8.0.jarZip4j - A Java library for zip files and streams
Library home page: https://github.com/srikanth-lingala/zip4j
Path to dependency file: /nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184332/zip4j-2.8.0.jar
Dependency Hierarchy: - :x: **zip4j-2.8.0.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsZip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
Publish Date: 2023-01-10
URL: CVE-2023-22899
### CVSS 3 Score Details (5.9)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-2pj2-gchf-wmw7
Release Date: 2023-01-10
Fix Resolution: 2.11.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-24615
### Vulnerable Library - zip4j-2.8.0.jarZip4j - A Java library for zip files and streams
Library home page: https://github.com/srikanth-lingala/zip4j
Path to dependency file: /nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/pom.xml
Path to vulnerable library: /812183939_HVCZJO/downloadResource_PPNSGT/20210812184332/zip4j-2.8.0.jar
Dependency Hierarchy: - :x: **zip4j-2.8.0.jar** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailszip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
Publish Date: 2022-02-24
URL: CVE-2022-24615
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24615
Release Date: 2022-02-24
Fix Resolution: 2.10.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.