REDHAT-BUG-1635888: Medium severity ZZIPlib ZZIPlib vulnerability
A flaw was found in ZZIPlib 0.13.69. A directory traversal vulnerability allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzipcat in the bins/unzzipcat-mem.c file.
References: https://github.com/gdraheim/zziplib/issues/62
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1635888?
The severity of REDHAT-BUG-1635888 is classified as a high risk due to the potential for arbitrary file overwriting.
How do I fix REDHAT-BUG-1635888?
To fix REDHAT-BUG-1635888, update ZZIPlib to version 0.13.70 or later where the vulnerability has been patched.
What is the impact of REDHAT-BUG-1635888?
The impact of REDHAT-BUG-1635888 includes the possibility for attackers to exploit directory traversal to overwrite files on the system.
Which versions of ZZIPlib are affected by REDHAT-BUG-1635888?
ZZIPlib versions prior to 0.13.70 are affected by REDHAT-BUG-1635888.
Is there a workaround for REDHAT-BUG-1635888?
A potential workaround for REDHAT-BUG-1635888 involves implementing strict input validation on zip file contents to prevent directory traversal.