PT-2022-16764 · Zip4J+1 · Zip4J+1

Published 2022-02-24 · Updated 2022-04-19 · CVE-2022-24615

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions zip4j versions up to 2.10.0

Description The issue allows an attacker to throw various uncaught exceptions while parsing a specially crafted ZIP file, potentially resulting in an application crash. This could be used to mount a denial of service attack against services that use the zip4j library.

Recommendations For zip4j versions up to 2.10.0, update to a version that contains a fix for this issue to prevent potential application crashes and denial of service attacks.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-248

Related Identifiers

CVE-2022-24615

GHSA-Q62H-JW38-24VH

Affected Products

Debian

Zip4J

References · 11

• https://osv.dev/vulnerability/CVE-2022-24615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24615 · Security Note
• https://osv.dev/vulnerability/GHSA-q62h-jw38-24vh · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-24615 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-24615 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24615 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-24615 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24615 · Vendor Advisory
• https://github.com/srikanth-lingala/zip4j/issues/418 · Note
• https://github.com/srikanth-lingala/zip4j/issues/377 · Note
• https://github.com/srikanth-lingala/zip4j · Note