GHSA-2pj2-gchf-wmw7

Zip4j Origin Validation Error

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-22899

Packages

Ecosystem	Package	Affected	Fixed in
Maven	net.lingala.zip4j:zip4j	< 2.11.3	2.11.3

Details

As written in the advisory (Markdown source, shown as plain text).

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. This issue has been fixed in version 2.11.3.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-22899 advisory
https://github.com/srikanth-lingala/zip4j/issues/485 web
https://breakingthe3ma.app web
https://breakingthe3ma.app/files/Threema-PST22.pdf web
https://github.com/srikanth-lingala/zip4j package
https://github.com/srikanth-lingala/zip4j/releases web
https://github.com/srikanth-lingala/zip4j/releases/tag/v2.11.3 web
https://news.ycombinator.com/item?id=34316206 web
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement web