CVE-2023-39136

Опубликовано: 30 авг. 2023

Источник: nvd

CVSS3: 5.5

EPSS Низкий

Описание

An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.

Ссылки

https://blog.ostorlab.co/zip-packages-exploitation.html
Exploit
Third Party Advisory
https://github.com/ZipArchive/ZipArchive/issues/680
Exploit
Issue Tracking
Patch
Vendor Advisory
https://ostorlab.co/vulndb/advisory/OVE-2023-2
Exploit
Third Party Advisory
https://security.snyk.io/research/zip-slip-vulnerability
Third Party Advisory
https://blog.ostorlab.co/zip-packages-exploitation.html
Exploit
Third Party Advisory
https://github.com/ZipArchive/ZipArchive/issues/680
Exploit
Issue Tracking
Patch
Vendor Advisory
https://ostorlab.co/vulndb/advisory/OVE-2023-2
Exploit
Third Party Advisory
https://security.snyk.io/research/zip-slip-vulnerability
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ziparchive_project:ziparchive:2.5.4:*:*:*:*:*:*:*

EPSS

Процентиль: 17%

0.00053

Низкий

5.5 Medium

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-703

Связанные уязвимости

GHSA-rh4c-32wr-89cj