Source: rust-zip Version: 5.1.1+dfsg-1 X-Debbugs-CC: [email protected] Severity: grave Tags: security upstream
Hi, The following vulnerabilities were published for rust-zip. CVE-2026-115905[0]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory | File Header filenames as authoritative while ZipStreamReader | extracts using Local File Header filenames without reconciling the | duplicate metadata in src/read/stream.rs. A crafted archive can | therefore appear benign to a component that inspects the central | directory but cause a streaming extractor to write a different | attacker-selected path and content, potentially overwriting files | used by a downstream service. This issue is fixed in version 9.0.5. CVE-2026-115906[1]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in | src/aes.rs verifies its HMAC only when the attacker-controlled data | counter reaches zero. If the underlying bounded reader reaches the | real end of the archive while data_remaining is still positive, or | if an encrypted entry has no payload, the reader can return a clean | end of stream without reading and comparing the authentication tag. | Applications using by_index_decrypt, by_name_decrypt, | by_path_decrypt, or password-enabled by_index_with_options can | therefore accept modified plaintext without an authentication error. | This issue is fixed in version 9.0.0. CVE-2026-115907[2]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 5.1.0 until 9.0.0, applications built with | the legacy-zip feature can reserve output capacity from an attacker- | controlled ZIP64 uncompressed size before validating the compressed | stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic | with a capacity overflow during ZipArchive::extract, and the Reduce | and Implode decoders contain the same unbounded preallocation | pattern. An unhandled panic can terminate an archive-processing | service. This issue is fixed in version 9.0.0. CVE-2026-115909[3]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in | src/read/mod.rs calls Vec::with_capacity for a symbolic link target | using the attacker-controlled ZIP64 uncompressed_size before reading | entry data. A small archive can request an impossible capacity, | causing the infallible allocation path to abort the process before | the entry is validated. The failure cannot be contained with | catch_unwind or a worker thread, allowing repeated denial of service | in archive-processing applications. This issue is fixed in version | 9.0.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115905 https://www.cve.org/CVERecord?id=CVE-2026-115905 [1] https://security-tracker.debian.org/tracker/CVE-2026-115906 https://www.cve.org/CVERecord?id=CVE-2026-115906 [2] https://security-tracker.debian.org/tracker/CVE-2026-115907 https://www.cve.org/CVERecord?id=CVE-2026-115907 [3] https://security-tracker.debian.org/tracker/CVE-2026-115909 https://www.cve.org/CVERecord?id=CVE-2026-115909 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
