[
https://issues.apache.org/jira/browse/OFBIZ-12056?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jacques Le Roux closed OFBIZ-12056.
-----------------------------------
Fix Version/s: 18.12.01
Resolution: Fixed
R17 is not concerned, more recent code
> Prevent Zip Slip vulnerability
> ------------------------------
>
> Key: OFBIZ-12056
> URL: https://issues.apache.org/jira/browse/OFBIZ-12056
> Project: OFBiz
> Issue Type: Sub-task
> Components: framework/base
> Affects Versions: Trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
> Fix For: 18.12.01
>
>
> While working with FileUtil::unzipFileToFolder I noticed that it's vulnerable
> to Zip slip vulnerability: https://snyk.io/research/zip-slip-vulnerability.
> Fortunately OOTB code does not use FileUtil::unzipFileToFolder so I did not
> create a CVE, nor reported to
> https://github.com/snyk/zip-slip-vulnerability#user-content-projects-affected-and-fixed.
> If you think we should please shime in...
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
