zip: AES Entry HMAC Authentication Bypass on Premature EOF

Summary An AES-encrypted AE-x entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared compressedsize, the counter remains positive, the HMAC is...

GHSA-8HXF-QR8P-62X4 zip: AES Entry HMAC Authentication Bypass on Premature EOF

Summary An AES-encrypted AE-x entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared compressedsize, the counter remains positive, the HMAC is...

GHSA-Q7V9-X93C-XQV3 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction

Summary The symbolic-link branch of ZipArchive::extractinternal allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with SIGABRT through this infallible allocation. Details rust cfganyunix, windows if file.issymlin...

RUSTSEC-2025-0168 Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

In the archive extraction routine of affected versions of the zip crate, symbolic links earlier in the archive are allowed to be used for later files in the archive without validation of the final canonicalized path, allowing maliciously crafted archives to overwrite arbitrary files in the file...