GHSA-m6cj-93v6-cvr5

Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Source: GitHub Advisory Database (reviewed) High CVE-2022-23596

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.github.junrar:junrar	< 7.4.1	7.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. ### Patches The problem is partially patched in 7.4.1 ### Workarounds None ### References https://github.com/junrar/junrar/issues/73 https://github.com/junrar/junrar/issues/81

References

External links from the advisory. They lead to third-party sites.

https://github.com/junrar/junrar/security/advisories/GHSA-m6cj-93v6-cvr5 web
https://nvd.nist.gov/vuln/detail/CVE-2022-23596 advisory
https://github.com/junrar/junrar/issues/73 web
https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7 web
https://github.com/junrar/junrar package