What is GHSA-m6cj-93v6-cvr5?

GHSA-m6cj-93v6-cvr5 is a security advisory published by GitHub Security Advisories with High severity. Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Which CVE IDs does GHSA-m6cj-93v6-cvr5 cover?

GHSA-m6cj-93v6-cvr5 covers the following CVE IDs: CVE-2022-23596. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m6cj-93v6-cvr5?

GHSA-m6cj-93v6-cvr5 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-m6cj-93v6-cvr5?

GHSA-m6cj-93v6-cvr5 affects 1 product, including: maven/com.github.junrar:junrar:\u003c 7.4.1.

GHSA-m6cj-93v6-cvr5HighCVSS 7.5

Junrar vulnerable to infinite loop via extracting carefully crafted RAR archive

Vendor

GitHub Security Advisories

Published

February 1, 2022

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-23596 →

📋 Description

Impact

A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users.

Patches

The problem is partially patched in 7.4.1

Workarounds

None

References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81

🎯 Affected products1

maven/com.github.junrar:junrar:< 7.4.1

🔗 References (5)

https://github.com/junrar/junrar/security/advisories/GHSA-m6cj-93v6-cvr5
https://github.com/junrar/junrar/issues/73
https://github.com/junrar/junrar/commit/7b16b3d90b91445fd6af0adfed22c07413d4fab7
https://nvd.nist.gov/vuln/detail/CVE-2022-23596
https://github.com/advisories/GHSA-m6cj-93v6-cvr5