CVE-2023-22899 Zip4j Origin Validation Error
Attackers can bypass integrity checks when decrypting ZIP archives using Zip4j, potentially allowing tampered data to be processed as valid.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-22899?
CVE-2023-22899 is a medium-severity vulnerability in n/a, published on 10 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
Weakness: CWE-346
Which versions are affected by CVE-2023-22899?
2 open source packages ship an affected version, including net.lingala.zip4j:zip4j. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
net.lingala.zip4j:zip4j Maven | All versions | 2.11.3 |
net.lingala.zip4j:zip4j Maven | All versions | 2.11.3 |
Products include Zip4j Project Zip4j.
How do I fix CVE-2023-22899?
Upgrade net.lingala.zip4j:zip4j to 2.11.3 or later.
Is CVE-2023-22899 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22899 exists.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2023-22899, GHSA-2pj2-gchf-wmw7, UBUNTU-CVE-2023-22899.