CVE-2024-22405

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-22405
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22405.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-22405
Aliases
  • GHSA-xg3c-r7w5-7xw2
Published
2024-04-30T10:04:24Z
Modified
2026-08-12T14:52:01Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
XADMaster may not apply quarantine attribute correctly to extracted files
Details

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-281"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22405.json"
}
References

Affected packages

Git / github.com/macpaw/xadmaster

Affected ranges

Type
GIT
Repo
https://github.com/macpaw/xadmaster
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b75c05bc3bca9e183ecd3c512e270ce93006da3c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.10.8"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.10.4
v1.10.5
v1.10.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22405.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57030278688959399879208055579493420661",
                "299671498715500230373326747911272210059",
                "92428439190562665250018665482411573896",
                "173204359438651740369577200314781610808"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-22405-ad5c9081",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/macpaw/xadmaster/commit/b75c05bc3bca9e183ecd3c512e270ce93006da3c",
        "target": {
            "file": "XADUnarchiver.h"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T14:52:01Z"