Improper Verification of Cryptographic Signature in zip4j - CVE-2023-22899

Vulnerability identifier: #VU74270

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-22899

CWE-ID: CWE-347

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to zip4j does not always perform validation of MAC when decrypting a ZIP archive. A remote attacker can submit a malicious archive or tamper with data inside one.

zip4j
SecureTransport
Oracle Access Manager
Middleware Common Libraries and Tools
Oracle Middleware Common Libraries and Tools
Migration Toolkit for Runtimes
IBM Cloud Transformation Advisor
Red Hat Migration Toolkit for Applications
IBM App Connect Enterprise

Install updates from vendor's website.

zip4j - update to 2.11.3
SecureTransport - update to 5.5-20230223
Migration Toolkit for Runtimes - update to 1.1.1
IBM Cloud Transformation Advisor - update to 3.4.2
Red Hat Migration Toolkit for Applications - update to 6.2.0
IBM App Connect Enterprise - addressed in versions 11.0.0.21, 12.0.8.0

• https://breakingthe3ma.app/files/Threema-PST22.pdf
• https://news.ycombinator.com/item?id=34316206
• https://github.com/srikanth-lingala/zip4j/releases
• https://breakingthe3ma.app
• https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement
• https://github.com/srikanth-lingala/zip4j/issues/485

• Missing MAC validation in Zip4j
• Multiple vulnerabilities in Axway SecureTransport (February 2023)
• Multiple vulnerabilities in Oracle Access Manager
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Improper verification of cryptographic signature in IBM App Connect Enterprise
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools