Infinite loop in ZZIPlib - CVE-2020-18442

Vulnerability identifier: #VU79772

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-18442

CWE-ID: CWE-835

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the unzzip_cat_file() function. A remote attacker can consume all available system resources and cause denial of service conditions.

ZZIPlib
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Workstation Extension
Ubuntu
openEuler
Fedora
libzzip-0-13 (Ubuntu package)
libzzip-dev (Ubuntu package)
zziplib-bin (Ubuntu package)
zziplib-devel-debuginfo
zziplib-devel
zziplib-debugsource
libzzip-0-13-debuginfo
libzzip-0-13
zziplib (Red Hat package)
zziplib-help
zziplib-debuginfo
zziplib

Install update from vendor's website.

ZZIPlib - update to 0.13.72
libzzip-0-13 (Ubuntu package) - addressed in versions Ubuntu Pro, 0.13.62-3.2ubuntu1.1
libzzip-dev (Ubuntu package) - addressed in versions Ubuntu Pro, 0.13.62-3.2ubuntu1.1
zziplib-bin (Ubuntu package) - addressed in versions Ubuntu Pro, 0.13.62-3.2ubuntu1.1
zziplib-devel-debuginfo - update to 0.13.67-10.33.1
zziplib-devel - update to 0.13.67-10.33.1
zziplib-debugsource - update to 0.13.67-10.33.1
libzzip-0-13-debuginfo - update to 0.13.67-10.33.1
libzzip-0-13 - update to 0.13.67-10.33.1
zziplib (Red Hat package) - update to 0.13.68-9.el8
zziplib-help - update to 0.13.69-8
zziplib-debuginfo - update to 0.13.69-8
zziplib-debugsource - update to 0.13.69-8
zziplib-devel - update to 0.13.69-8
zziplib - update to 0.13.69-8
zziplib - update to 0.13.72-1
zziplib - addressed in versions 0.13.72-1.fc34, 0.13.72-1.fc35, 0.13.72-1.fc36, 0.13.72-1.fc37

• https://github.com/gdraheim/zziplib/issues/68
• https://lists.debian.org/debian-lts-announce/2021/12/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCFYD46OY4VAGJ4UX7IFOH5SHD4UW4ZA/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VVANTEBDQGOIPC5KCEVAGA5KT4KKTGWB/

• Denial of service in zziplib
• Ubuntu update for zziplib
• openEuler 20.03 LTS SP1 update for zziplib
• Amazon Linux AMI update for zziplib
• Red Hat Enterprise Linux 8 update for zziplib
• SUSE update for zziplib
• Fedora 37 update for zziplib
• Fedora 36 update for zziplib
• Fedora 35 update for zziplib
• Fedora 34 update for zziplib