CVE-2022-23596: Infinite loop in junrar
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23596?
CVE-2022-23596 is considered a significant security vulnerability due to the potential for an infinite loop when extracting maliciously crafted RAR archives.
How do I fix CVE-2022-23596?
To mitigate CVE-2022-23596, you should upgrade to the Junrar library version 7.4.1 or later.
Which versions of Junrar are affected by CVE-2022-23596?
CVE-2022-23596 affects all versions of Junrar prior to version 7.4.1.
What type of vulnerability is CVE-2022-23596?
CVE-2022-23596 is a denial of service vulnerability due to an infinite loop caused by a specially crafted RAR archive.
Can CVE-2022-23596 be exploited remotely?
Yes, CVE-2022-23596 can be exploited remotely if an application using Junrar handles input from untrusted sources.