CVE-2022-36943

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-36943
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36943.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-36943
Aliases
  • GHSA-vgvw-6xcf-qqfc
Published
2023-01-03T00:00:00Z
Modified
2026-07-15T01:49:20.346606190Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
Summary
[none]
Details

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

Database specific 
{
    "cna_assigner": "facebook",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.5.3"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36943.json"
}
References

Affected packages

Git / github.com/ziparchive/ziparchive

Affected ranges

Type
GIT
Repo
https://github.com/ziparchive/ziparchive
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3016df0730fb7daa85d73e29ec9d02851db831ae
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.5.3"
        }
    ],
    "cpe": "cpe:2.3:a:ziparchive_project:ziparchive:*:*:*:*:*:*:*:*"
}

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.2.0
0.2.2
0.2.3
0.2.4
0.2.5
0.3.0
0.3.1
0.3.2
0.3.3
0.4.0
1.*
1.0.1
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.8.0
1.8.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
v0.*
v0.1.0
v0.1.1
v0.2.0
v0.2.2
v0.2.3
v0.2.4
v0.2.5
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v1.*
v1.0.1
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.8.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36943.json"