Moderate Security Update for zziplib: Addressing Directory Traversal Vulnerability
Summary
ALSA-2025:20478: Moderate: zziplib security update. Affects zziplib versions < 0.13.78-2.el10. Fixed in 0.13.78-2.el10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
zziplib is a lightweight library designed for extracting data from zip files efficiently. It provides a simple interface for developers to work with zip archives, making it a popular choice in various applications. However, zziplib has been found to be vulnerable to a directory traversal issue, which can potentially allow unauthorized access to the file system.
Vulnerability Detail
The vulnerability identified as CVE-2018-17828 affects the unzzip_cat function in the bins/unzzipcat-mem.c file of zziplib. This directory traversal vulnerability can be exploited by an attacker to access files outside the intended directory structure, leading to unauthorized file access and potential data leakage. The issue arises from improper validation of user-supplied input, which allows attackers to manipulate file paths.
How To Fix
Minimum fixed version
0.13.78-2.el10
This is the first release that contains the fix.
sudo dnf update zziplibTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the affected functionality by implementing strict input validation and sanitization in your application code. Ensure that any file paths provided by users are validated against a whitelist of acceptable paths.
Conclusion
The zziplib library has a moderate security vulnerability that can lead to directory traversal attacks. It is crucial to update to the latest patched version to mitigate risks. Additionally, implementing workarounds can provide temporary relief until the update can be applied.
See every vulnerability recorded for zziplib →
FAQ
CVE-2018-17828 is a directory traversal vulnerability in zziplib that allows attackers to access files outside the intended directory structure.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files, data leakage, and potential exploitation of the system by attackers.
Yes, a patch is available in version 0.13.78-2.el10 of zziplib and its related packages.
If immediate updates are not possible, implement strict input validation and restrict access to the affected functionality as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for zziplib.
