CVE-2022-24615: Uncaught Exception in zip4j

February 24, 2022 (updated April 19, 2022)

zip4j up to 2.9.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.

References

github.com/advisories/GHSA-q62h-jw38-24vh
github.com/srikanth-lingala/zip4j/issues/377
nvd.nist.gov/vuln/detail/CVE-2022-24615

Code Behaviors & Features

Detect and mitigate CVE-2022-24615 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →