Zip2
Monthly
Process abort denial of service in the Rust `zip` crate (versions 1.3.0 through 8.x) allows a tiny, crafted archive to kill any application that calls `ZipArchive::extract()` on untrusted input. The symlink branch of extraction reserves a buffer using the attacker-declared ZIP64 `uncompressed_size` before reading a single byte; `Vec::with_capacity` is infallible, so a 112-byte archive declaring 2^62 bytes terminates the process via `SIGABRT` - an abort that `catch_unwind`, `panic = "unwind"` and worker-thread isolation all fail to contain. Impact is availability only (C:N/I:N/A:H, 7.5); the vendor GHSA publishes a public reproducer, no confirmed active exploitation is reported in the available data, and the flaw is fixed in 9.0.0.
Arbitrary file write outside the extraction directory in the Rust zip2 crate 7.2.0 through 9.0.0 lets a crafted ZIP create or overwrite files with the extracting process's privileges when an application calls ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir. The symlink-target check is purely lexical, so an attacker who knows or can guess the absolute destination path can supply a chain whose apparent target stays under the destination while an intermediate link resolves outside it; on Windows a single link is enough because drive and UNC prefixes are discarded, provided the extracting process holds SeCreateSymbolicLinkPrivilege. The GitHub advisory ships proof-of-concept reproduction detail, including a real-hardware Windows test, but no CISA KEV entry exists and public working exploit code is not confirmed in the supplied data; severity is rated 7.4 with AC:H reflecting the destination-path precondition.
Denial of service in the Rust zip2 crate affects versions 5.1.0 through 8.x when an application is built with the opt-in `legacy-zip` feature and extracts an attacker-supplied archive containing a Shrink, Reduce, or Implode entry with a forged ZIP64 uncompressed size. The declared size is passed to `Vec::reserve` before the compressed stream is validated, causing a deterministic capacity-overflow panic (CWE-400/CWE-789) that can terminate the archive-processing process. The issue is fixed in 9.0.0; a public proof-of-concept reproducer is documented in the GHSA advisory, there is no CISA KEV confirmation in the provided intelligence, and exposure is limited by the non-default `legacy-zip` build configuration and a `ZipArchive::extract()`-style read path.
A parser differential in the Rust `zip` crate (zip2) through 9.0.4 lets a crafted archive present different filenames to different readers: the random-access `ZipArchive` API trusts the Central Directory File Header while the unstable streaming `ZipStreamReader` extracts using the unverified Local File Header name, writing to an attacker-chosen path without reconciling the two. Applications that scan uploads with a Central-Directory-first tool and then extract with the streaming reader can be tricked into overwriting files on disk, giving integrity and availability impact and potentially code execution if the overwritten file is later executed. The advisory includes a public proof-of-concept integration test with claimed verified execution output, but there is no CISA KEV listing and no confirmed report of exploitation in the wild; exploitation is conditional on the consuming application actually using the unstable streaming API in a decoupled scan-then-extract pipeline.
Integrity bypass in the zip2 Rust crate (0.6.0 through versions below 9.0.0) lets an attacker who can modify or supply a ZIP archive deliver altered or attacker-chosen plaintext from an AES-encrypted entry that is read through the password-bearing APIs, with no authentication error raised. The HMAC-SHA1-80 tag in src/aes.rs is only checked when the reader's byte counter reaches zero, so a crafted entry that hits true end-of-file while the header-declared compressed_size still leaves data remaining - or an entry with zero payload - returns a clean end of stream and skips the tag comparison entirely; because AES-CTR is malleable, the modification needs no knowledge of the password. Scored CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), it is unauthenticated from the attacker's side but requires the victim to open the crafted archive with a valid password through by_index_decrypt, by_name_decrypt, by_path_decrypt, or by_index_with_options; impact is integrity-only, with AE-2 entries additionally losing their by-design-disabled CRC-32 check so no integrity verification of any kind remains. A public PoC reference exists in the form of the advisory's test code; it is not verified as working exploit code outside that context, and no active exploitation is indicated. Fixed in 9.0.0.
Process abort denial of service in the Rust `zip` crate (versions 1.3.0 through 8.x) allows a tiny, crafted archive to kill any application that calls `ZipArchive::extract()` on untrusted input. The symlink branch of extraction reserves a buffer using the attacker-declared ZIP64 `uncompressed_size` before reading a single byte; `Vec::with_capacity` is infallible, so a 112-byte archive declaring 2^62 bytes terminates the process via `SIGABRT` - an abort that `catch_unwind`, `panic = "unwind"` and worker-thread isolation all fail to contain. Impact is availability only (C:N/I:N/A:H, 7.5); the vendor GHSA publishes a public reproducer, no confirmed active exploitation is reported in the available data, and the flaw is fixed in 9.0.0.
Arbitrary file write outside the extraction directory in the Rust zip2 crate 7.2.0 through 9.0.0 lets a crafted ZIP create or overwrite files with the extracting process's privileges when an application calls ZipArchive::extract or ZipArchive::extract_unwrapped_root_dir. The symlink-target check is purely lexical, so an attacker who knows or can guess the absolute destination path can supply a chain whose apparent target stays under the destination while an intermediate link resolves outside it; on Windows a single link is enough because drive and UNC prefixes are discarded, provided the extracting process holds SeCreateSymbolicLinkPrivilege. The GitHub advisory ships proof-of-concept reproduction detail, including a real-hardware Windows test, but no CISA KEV entry exists and public working exploit code is not confirmed in the supplied data; severity is rated 7.4 with AC:H reflecting the destination-path precondition.
Denial of service in the Rust zip2 crate affects versions 5.1.0 through 8.x when an application is built with the opt-in `legacy-zip` feature and extracts an attacker-supplied archive containing a Shrink, Reduce, or Implode entry with a forged ZIP64 uncompressed size. The declared size is passed to `Vec::reserve` before the compressed stream is validated, causing a deterministic capacity-overflow panic (CWE-400/CWE-789) that can terminate the archive-processing process. The issue is fixed in 9.0.0; a public proof-of-concept reproducer is documented in the GHSA advisory, there is no CISA KEV confirmation in the provided intelligence, and exposure is limited by the non-default `legacy-zip` build configuration and a `ZipArchive::extract()`-style read path.
A parser differential in the Rust `zip` crate (zip2) through 9.0.4 lets a crafted archive present different filenames to different readers: the random-access `ZipArchive` API trusts the Central Directory File Header while the unstable streaming `ZipStreamReader` extracts using the unverified Local File Header name, writing to an attacker-chosen path without reconciling the two. Applications that scan uploads with a Central-Directory-first tool and then extract with the streaming reader can be tricked into overwriting files on disk, giving integrity and availability impact and potentially code execution if the overwritten file is later executed. The advisory includes a public proof-of-concept integration test with claimed verified execution output, but there is no CISA KEV listing and no confirmed report of exploitation in the wild; exploitation is conditional on the consuming application actually using the unstable streaming API in a decoupled scan-then-extract pipeline.
Integrity bypass in the zip2 Rust crate (0.6.0 through versions below 9.0.0) lets an attacker who can modify or supply a ZIP archive deliver altered or attacker-chosen plaintext from an AES-encrypted entry that is read through the password-bearing APIs, with no authentication error raised. The HMAC-SHA1-80 tag in src/aes.rs is only checked when the reader's byte counter reaches zero, so a crafted entry that hits true end-of-file while the header-declared compressed_size still leaves data remaining - or an entry with zero payload - returns a clean end of stream and skips the tag comparison entirely; because AES-CTR is malleable, the modification needs no knowledge of the password. Scored CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), it is unauthenticated from the attacker's side but requires the victim to open the crafted archive with a valid password through by_index_decrypt, by_name_decrypt, by_path_decrypt, or by_index_with_options; impact is integrity-only, with AE-2 entries additionally losing their by-design-disabled CRC-32 check so no integrity verification of any kind remains. A public PoC reference exists in the form of the advisory's test code; it is not verified as working exploit code outside that context, and no active exploitation is indicated. Fixed in 9.0.0.