unzip: CVE-2019-13232

Debian Bug report logs - #931433
unzip: CVE-2019-13232

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: unzip: CVE-2019-13232

Date: Thu, 04 Jul 2019 22:50:46 +0200

Source: unzip
Version: 6.0-23
Severity: important
Tags: security upstream
Control: found -1 6.0-21+deb9u1
Control: found -1 6.0-21

Hi,

The following vulnerability was published for unzip.

CVE-2019-13232[0]:
| Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP
| container, leading to denial of service (resource consumption), aka a
| "better zip bomb" issue.

There seem to be a fork onf Info-Zip UnZip, trying to address this
issue, but not sure if we should follow that.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-13232
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13232

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #14 received at 931433@bugs.debian.org (full text, mbox, reply):

From: Santiago Vila <sanvila@unex.es>

To: Salvatore Bonaccorso <carnil@debian.org>, 931433@bugs.debian.org

Subject: Re: Bug#931433: unzip: CVE-2019-13232

Date: Fri, 5 Jul 2019 12:57:31 +0200

On Thu, Jul 04, 2019 at 10:50:46PM +0200, Salvatore Bonaccorso wrote:
> Source: unzip
> Version: 6.0-23
> Severity: important
> Tags: security upstream
> Control: found -1 6.0-21+deb9u1
> Control: found -1 6.0-21
> 
> Hi,
> 
> The following vulnerability was published for unzip.
> 
> CVE-2019-13232[0]:
> | Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP
> | container, leading to denial of service (resource consumption), aka a
> | "better zip bomb" issue.
> 
> There seem to be a fork onf Info-Zip UnZip, trying to address this
> issue, but not sure if we should follow that.

Hello Salvatore. Thanks for the report.

You probably mean the github repository by Mark Adler:

https://github.com/madler/unzip

The description says "Fork of InfoZIP UnZip 6.0 for new zip bomb
detection patch" so I would consider this just as a way to distribute
the patch fixing the bug, more than a proper "fork".

(Note: Mark Adler was one of the original unzip authors, I'm glad
to see him still around).

I'll contact Steven M Schweda, the current maintainer.

Thanks.

Send a report that this bug log contains spam.