** Description changed: zip version 9.0.2 is now published on crates.io, but the latest version of the Ubuntu package is 5.1.1. 5.1.1 is probably vulnerable to 7 security issues that 9.0.2 fixes, 3 of which are already public and 4 of - which are to be published in late October: + which are to be published in late October. The public ones are: * https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp - - * https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3 Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction - * https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4 AES Entry HMAC Authentication Bypass on Premature EOF - * https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size - * https://github.com/zip-rs/zip2/security/advisories/GHSA-c9rm-qm35-rhq WinZip AES: HMAC verification skipped when the decompressor stops early, so forged content is accepted without the password
** Description changed: zip version 9.0.2 is now published on crates.io, but the latest version of the Ubuntu package is 5.1.1. 5.1.1 is probably vulnerable to 7 security issues that 9.0.2 fixes, 3 of which are already public and 4 of which are to be published in late October. The public ones are: * https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp + + Once the embargoed ones are public, they'll be at: + + * https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3 + * https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4 + * https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 + * https://github.com/zip-rs/zip2/security/advisories/GHSA-c9rm-qm35-rhqf ** Description changed: zip version 9.0.2 is now published on crates.io, but the latest version - of the Ubuntu package is 5.1.1. 5.1.1 is probably vulnerable to 7 - security issues that 9.0.2 fixes, 3 of which are already public and 4 of - which are to be published in late October. The public ones are: + of the Ubuntu package is 5.1.1. 5.1.1 is probably vulnerable to 7 known + security issues that were fixes in 9.0.0, 9.0.1 and 9.0.2. Three of + these are already public: * https://github.com/zip-rs/zip2/security/advisories/GHSA-vv5m-jxxh-4627 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4v9h-p7m9-rh26 * https://github.com/zip-rs/zip2/security/advisories/GHSA-4684-h2q9-2vcp - Once the embargoed ones are public, they'll be at: + The other four are to be published in late October at: * https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3 * https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4 * https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963 * https://github.com/zip-rs/zip2/security/advisories/GHSA-c9rm-qm35-rhqf -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170512 Title: Update to 9.0.2 from upstream To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rust-zip/+bug/2170512/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
