CVE-2022-23596 Infinite loop in junrar
A crafted RAR archive triggers an infinite loop in the junrar library, causing denial of service in applications that process untrusted archives.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23596?
CVE-2022-23596 is a high-severity denial of service vulnerability in n/a, published on 1 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
Weakness: CWE-835
Which versions are affected by CVE-2022-23596?
2 open source packages ship an affected version, including com.github.junrar:junrar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.github.junrar:junrar Maven | All versions | 7.4.1 |
com.github.junrar:junrar Maven | All versions | 7.4.1 |
Products include Junrar Project Junrar.
How do I fix CVE-2022-23596?
Upgrade com.github.junrar:junrar to 7.4.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-23596 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23596 exists.
Other vulnerabilities in n/a
Sources
Also known as ECHO-31ea-20fc-ade1, GHSA-m6cj-93v6-cvr5.