CVE-2022-24615: Uncaught Exception in zip4j
Summary
CVE-2022-24615: Uncaught Exception in zip4j. Affects net.lingala.zip4j:zip4j versions < 2.10.0. Fixed in 2.10.0. How to fix ↓
Also tracked for
- zip4j · Debian:11
The same CVE-2022-24615 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zip4j library is a popular open-source Java library used for creating, extracting, and manipulating ZIP files. It provides a simple and convenient API for working with ZIP archives. However, versions up to 2.9.1 of zip4j are vulnerable to a denial of service attack due to uncaught exceptions while parsing specially crafted ZIP files.
Vulnerability Detail
The vulnerability in zip4j arises from its failure to handle certain types of ZIP files correctly. An attacker can exploit this by crafting a malicious ZIP file that triggers uncaught exceptions during parsing. When an application using zip4j attempts to process such a file, it can crash due to the unhandled exceptions. This vulnerability can be leveraged to mount a denial of service attack against services that rely on the zip4j library.
How To Fix
Minimum fixed version
2.10.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of the zip4j library to mitigate the risk.
Conclusion
The vulnerability in zip4j can result in a denial of service attack by crashing applications that use the library. It is crucial to update to version 2.10.0 or later of the zip4j library to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for net.lingala.zip4j:zip4j →
FAQ
zip4j is an open-source Java library for working with ZIP files. It provides functionality for creating, extracting, and manipulating ZIP archives.
Versions up to 2.9.1 of zip4j are affected by this vulnerability.
This vulnerability can be exploited to crash applications that use the zip4j library, leading to a denial of service condition.
Yes, upgrading to version 2.10.0 or later of the zip4j library fixes this vulnerability.
No, updating to the fixed version of the zip4j library is the only recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.lingala.zip4j:zip4j.
