CVE-2023-22899

CVSS V2 None CVSS V3 None
Description
Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.
Overview
  • CVE ID
  • CVE-2023-22899
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-01-10T02:15:09
  • Last Modified Date
  • 2023-01-30T16:24:43
Weakness Enumerations
CWE URL
CWE-346 http://cwe.mitre.org/data/definitions/346.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:zip4j_project:zip4j:*:*:*:*:*:*:*:* 1 OR 2.11.2
References
Reference URL Reference Tags
https://breakingthe3ma.app Third Party Advisory
https://breakingthe3ma.app/files/Threema-PST22.pdf Exploit Technical Description Third Party Advisory
https://github.com/srikanth-lingala/zip4j/issues/485
https://github.com/srikanth-lingala/zip4j/releases Release Notes Third Party Advisory
https://news.ycombinator.com/item?id=34316206 Third Party Advisory
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement Vendor Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-22899
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22899
History
Created Old Value New Value Data Type Notes
2023-01-10 02:18:34 Added to TrackCVE
2023-01-10 14:18:48 2023-01-10T13:36:07 CVE Modified Date updated
2023-01-10 14:18:48 Received Awaiting Analysis Vulnerability Status updated
2023-01-12 18:17:15 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2023-01-13 18:19:27 2023-01-13T17:51:16 CVE Modified Date updated
2023-01-13 18:19:27 Undergoing Analysis Analyzed Vulnerability Status updated
2023-01-13 18:19:28 Weakness Enumeration new
2023-01-13 18:19:30 CPE Information updated
2023-01-26 23:15:29 2023-01-26T21:18:13 CVE Modified Date updated
2023-01-26 23:15:29 Analyzed Modified Vulnerability Status updated
2023-01-26 23:15:30 References updated
2023-01-27 11:16:57 Modified Undergoing Analysis Vulnerability Status updated
2023-01-30 17:14:44 2023-01-30T16:24:43 CVE Modified Date updated
2023-01-30 17:14:44 Undergoing Analysis Analyzed Vulnerability Status updated