Critical Vulnerability in p7zip: Error Handling Flaw in xz File Processing
Summary
DEBIAN-CVE-2022-47112: 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected. Affects p7zip versions < 16.02+transitional.1. Fixed in 16.02+transitional.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
p7zip is a command-line version of 7-Zip, a popular file archiver that supports various compression formats. It is widely used for compressing and decompressing files, providing high compression ratios and strong encryption capabilities. However, certain versions of p7zip, specifically 22.01, exhibit a vulnerability where invalid xz files do not trigger error reporting, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability arises from p7zip's failure to report errors for specific invalid xz files, particularly concerning stream flags and reserved bits. This oversight can result in the application processing corrupted or malformed files without alerting the user, which may lead to unexpected behavior or data loss. The issue is present in version 22.01, but later versions have addressed this flaw.
How To Fix
Minimum fixed version
16.02+transitional.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade p7zipTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually verify the integrity of xz files before processing them with p7zip. This can be done using alternative tools that provide better error handling for xz files.
Conclusion
The vulnerability in p7zip highlights a critical issue with error handling in specific xz files, which can lead to significant data integrity risks. Users are advised to update to the latest patched version to mitigate these risks and ensure the reliability of their file processing.
See every vulnerability recorded for p7zip →
FAQ
The vulnerability involves the failure to report errors for certain invalid xz files, which can lead to data integrity issues.
Version 22.01 of p7zip is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update p7zip to version 16.02+transitional.1 using the command 'sudo apt-get install p7zip'.
Yes, a temporary workaround is to manually verify the integrity of xz files before processing them with p7zip.
References
Related vulnerabilities
Recent vulnerabilities recorded for p7zip.
