An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.
References
| Link | Resource |
|---|---|
| https://blog.ostorlab.co/zip-packages-exploitation.html | Exploit Third Party Advisory |
| https://github.com/ZipArchive/ZipArchive/issues/680 | Exploit Issue Tracking Patch Vendor Advisory |
| https://ostorlab.co/vulndb/advisory/OVE-2023-2 | Exploit Third Party Advisory |
| https://security.snyk.io/research/zip-slip-vulnerability | Third Party Advisory |
Configurations
History
01 Oct 2024, 21:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-703 |
06 Sep 2023, 12:41
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Ziparchive Project
Ziparchive Project ziparchive |
|
| References | (MISC) https://blog.ostorlab.co/zip-packages-exploitation.html - Exploit, Third Party Advisory | |
| References | (MISC) https://security.snyk.io/research/zip-slip-vulnerability - Third Party Advisory | |
| References | (MISC) https://ostorlab.co/vulndb/advisory/OVE-2023-2 - Exploit, Third Party Advisory | |
| References | (MISC) https://github.com/ZipArchive/ZipArchive/issues/680 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
| CPE | cpe:2.3:a:ziparchive_project:ziparchive:2.5.4:*:*:*:*:*:*:* |
30 Aug 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-30 22:15
Updated : 2024-10-01 21:35
NVD link : CVE-2023-39136
Mitre link : CVE-2023-39136
CVE.ORG link : CVE-2023-39136
JSON object : View
Products Affected
ziparchive_project
- ziparchive
CWE