CVE-2023-22899

2023-01-1002:15:09

Debian Security Bug Tracker

security-tracker.debian.org

zip4j

decryption

vulnerability

threema

mac

zip archive

unix

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

50.9%

JSON

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

OSVersionArchitecturePackageVersionFilename
Debian12allzip4j< 2.11.2-3zip4j_2.11.2-3_all.deb
Debian11allzip4j<= 2.6.4-1zip4j_2.6.4-1_all.deb
Debian999allzip4j< 2.11.2-3zip4j_2.11.2-3_all.deb
Debian13allzip4j< 2.11.2-3zip4j_2.11.2-3_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	zip4j	< 2.11.2-3	zip4j_2.11.2-3_all.deb
Debian	11	all	zip4j	<= 2.6.4-1	zip4j_2.6.4-1_all.deb
Debian	999	all	zip4j	< 2.11.2-3	zip4j_2.11.2-3_all.deb
Debian	13	all	zip4j	< 2.11.2-3	zip4j_2.11.2-3_all.deb