What is GHSA-2pj2-gchf-wmw7?

GHSA-2pj2-gchf-wmw7 is a security advisory published by GitHub Security Advisories with Medium severity. Zip4j Origin Validation Error

Which CVE IDs does GHSA-2pj2-gchf-wmw7 cover?

GHSA-2pj2-gchf-wmw7 covers the following CVE IDs: CVE-2023-22899. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2pj2-gchf-wmw7?

GHSA-2pj2-gchf-wmw7 has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-2pj2-gchf-wmw7?

GHSA-2pj2-gchf-wmw7 affects 1 product, including: maven/net.lingala.zip4j:zip4j:\u003c= 2.11.2.

GHSA-2pj2-gchf-wmw7MediumCVSS 5.9

Zip4j Origin Validation Error

Vendor

GitHub Security Advisories

Published

January 10, 2023

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2023-22899 →

📋 Description

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. This issue has been fixed in version 2.11.3.

🎯 Affected products1

maven/net.lingala.zip4j:zip4j:<= 2.11.2

🔗 References (9)

https://nvd.nist.gov/vuln/detail/CVE-2023-22899
https://breakingthe3ma.app
https://breakingthe3ma.app/files/Threema-PST22.pdf
https://github.com/srikanth-lingala/zip4j/releases
https://news.ycombinator.com/item?id=34316206
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement
https://github.com/srikanth-lingala/zip4j/issues/485
https://github.com/srikanth-lingala/zip4j/releases/tag/v2.11.3
https://github.com/advisories/GHSA-2pj2-gchf-wmw7