Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update ZipArchive to 2.5.5 to fix two security issues #2748

Closed
BergQuester opened this issue Sep 4, 2024 · 3 comments
Closed

Update ZipArchive to 2.5.5 to fix two security issues #2748

BergQuester opened this issue Sep 4, 2024 · 3 comments

Comments

@BergQuester
Copy link

Steps to Reproduce

  1. ZipArchive has two known vulnerabilities in the version currently used (2.2.2)
    1. CVE-2022-36943: Arbitrary file write affecting ZipArchive version 2.5.3 and earlier.
    2. CVE-2023-39136: DoS via unhandled _sanitizedPath edge case affecting ZipArchive version 2.5.4 and earlier.

Expected Behavior

A version of ZipArchive is used that does not contain these vulnerabilities

Actual Behavior

The current version used is unpatched

There is a PR that was closed that updated ZipArchive to a patched version: #2709

@BergQuester BergQuester changed the title Update ZipArchive to 2.5.5 two fix security issues Update ZipArchive to 2.5.5 to fix two security issues Sep 4, 2024
@DmitriyKirakosyan
Copy link
Contributor

@BergQuester, thank you for your report! I've reopened the PR. We’ll keep you updated in this thread once it’s merged and released!

@DmitriyKirakosyan
Copy link
Contributor

@BergQuester, please note that this update will require the minimum iOS versions to be set to 15.5 or higher, as it is a requirement of ZipArchive 2.5.5. You can update this by modifying your podfile, see this comment.

@MikhailSuendukov
Copy link
Contributor

A fix for this issue was released with the AppCenter SDK ReactNative v9.0.0, so I'm closing this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants