Bug 2185278 (CVE-2023-22899)

Summary:	CVE-2023-22899 zip4j: does not always check the MAC when decrypting a ZIP archive
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alampare, alazarot, dhanak, emingora, gjospin, ibek, jrokos, kverlaen, lbacciot, mnovotny, pjindal, rguimara, rjohnson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	zip4j 2.11.3	Doc Type:	---
Doc Text:	A flaw was found in Zip4j. In this issue, it does not always check the MAC when decrypting a ZIP archive.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-27 15:28:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2159754

Description Chess Hazlett 2023-04-07 18:31:03 UTC

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

Comment 3 errata-xmlrpc 2023-06-27 10:56:40 UTC

This issue has been addressed in the following products:

  Migration Toolkit for Runtimes 1 on RHEL 8

Via RHSA-2023:3814 https://access.redhat.com/errata/RHSA-2023:3814

Comment 4 Product Security DevOps Team 2023-06-27 15:28:48 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-22899

Comment 5 errata-xmlrpc 2023-08-14 01:02:51 UTC

This issue has been addressed in the following products:

  MTA-6.2-RHEL-9
  MTA-6.2-RHEL-8

Via RHSA-2023:4627 https://access.redhat.com/errata/RHSA-2023:4627