What is GHSA-q62h-jw38-24vh?

GHSA-q62h-jw38-24vh is a security advisory published by GitHub Security Advisories with Medium severity. Uncaught Exception in zip4j

Which CVE IDs does GHSA-q62h-jw38-24vh cover?

GHSA-q62h-jw38-24vh covers the following CVE IDs: CVE-2022-24615. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q62h-jw38-24vh?

GHSA-q62h-jw38-24vh has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-q62h-jw38-24vh?

GHSA-q62h-jw38-24vh affects 1 product, including: maven/net.lingala.zip4j:zip4j:\u003c 2.10.0.

GHSA-q62h-jw38-24vhMediumCVSS 5.5

Uncaught Exception in zip4j

Vendor

GitHub Security Advisories

Published

February 25, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-24615 →

📋 Description

zip4j up to 2.9.1 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.

🎯 Affected products1

maven/net.lingala.zip4j:zip4j:< 2.10.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-24615
https://github.com/srikanth-lingala/zip4j/issues/377
https://github.com/srikanth-lingala/zip4j/issues/418
https://github.com/advisories/GHSA-q62h-jw38-24vh