You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@ofbiz.apache.org by "Jacques Le Roux (Jira)" <ji...@apache.org> on 2020/11/14 10:18:00 UTC

[jira] [Created] (OFBIZ-12056) Prevent Zip Slip vulnerability

Jacques Le Roux created OFBIZ-12056:
---------------------------------------

             Summary: Prevent Zip Slip vulnerability
                 Key: OFBIZ-12056
                 URL: https://issues.apache.org/jira/browse/OFBIZ-12056
             Project: OFBiz
          Issue Type: Sub-task
          Components: framework/base
    Affects Versions: Trunk
            Reporter: Jacques Le Roux


While working with FileUtil::unzipFileToFolder I noticed that it's vulnerable to Zip slip vulnerability: https://snyk.io/research/zip-slip-vulnerability.

Fortunately OOTB code does not use FileUtil::unzipFileToFolder so I did not create a CVE, nor reported to https://github.com/snyk/zip-slip-vulnerability#user-content-projects-affected-and-fixed. If you think we should please shime in...



--
This message was sent by Atlassian Jira
(v8.3.4#803005)