You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2020/11/14 10:50:00 UTC
[jira] [Commented] (OFBIZ-12056) Prevent Zip Slip vulnerability
[ https://issues.apache.org/jira/browse/OFBIZ-12056?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17231984#comment-17231984 ]
ASF subversion and git services commented on OFBIZ-12056:
---------------------------------------------------------
Commit e136cb1d9885fc6e0910637542308a9b7c10eb9f in ofbiz-framework's branch refs/heads/trunk from Jacques Le Roux
[ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=e136cb1 ]
Fixed: Prevent Zip Slip vulnerability (OFBIZ-12056)
While working with FileUtil::unzipFileToFolder I noticed that it's vulnerable to
Zip slip vulnerability: https://snyk.io/research/zip-slip-vulnerability.
Fortunately OOTB code does not use FileUtil::unzipFileToFolder so I did not
create a CVE, nor reported to
https://github.com/snyk/zip-slip-vulnerability#user-content-projects-affected-and-fixed.
If you think we should please shime in...
> Prevent Zip Slip vulnerability
> ------------------------------
>
> Key: OFBIZ-12056
> URL: https://issues.apache.org/jira/browse/OFBIZ-12056
> Project: OFBiz
> Issue Type: Sub-task
> Components: framework/base
> Affects Versions: Trunk
> Reporter: Jacques Le Roux
> Assignee: Jacques Le Roux
> Priority: Major
>
> While working with FileUtil::unzipFileToFolder I noticed that it's vulnerable to Zip slip vulnerability: https://snyk.io/research/zip-slip-vulnerability.
> Fortunately OOTB code does not use FileUtil::unzipFileToFolder so I did not create a CVE, nor reported to https://github.com/snyk/zip-slip-vulnerability#user-content-projects-affected-and-fixed. If you think we should please shime in...
--
This message was sent by Atlassian Jira
(v8.3.4#803005)