CVE-2023-22899 - Vulnerability Details - OpenCVE

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Migration Toolkit Applications Migration Toolkit Runtimes
Zip4j Project	Zip4j

Configuration 1 [-]

cpe:2.3:a:zip4j_project:zip4j:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Migration Toolkit for Runtimes 1 on RHEL 8
org.jboss.windup-windup-parent	cpe:/a:redhat:migration_toolkit_runtimes:1.0::el8	RHSA-2023:3814	2023-06-27T00:00:00Z
MTA-6.2-RHEL-9
mta/mta-operator-bundle:6.2.0-29	cpe:/a:redhat:migration_toolkit_applications:6.2::el9	RHSA-2023:4627	2023-08-14T00:00:00Z

References

Link	Providers
https://breakingthe3ma.app
https://breakingthe3ma.app/files/Threema-PST22.pdf
https://github.com/srikanth-lingala/zip4j/issues/485
https://github.com/srikanth-lingala/zip4j/releases
https://news.ycombinator.com/item?id=34316206
https://nvd.nist.gov/vuln/detail/CVE-2023-22899
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement
https://www.cve.org/CVERecord?id=CVE-2023-22899

History

Wed, 09 Apr 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-01-10T00:00:00.000Z

Updated: 2025-04-09T15:31:44.778Z

Reserved: 2023-01-10T00:00:00.000Z

Link: CVE-2023-22899

Vulnrichment

Updated: 2024-08-02T10:20:31.194Z

NVD

Status : Modified

Published: 2023-01-10T02:15:09.997

Modified: 2025-04-09T16:15:23.917

Link: CVE-2023-22899

Redhat

Severity : Moderate

Publid Date: 2023-01-10T00:00:00Z

Links: CVE-2023-22899 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-22899", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-09T15:31:44.778Z", "dateReserved": "2023-01-10T00:00:00.000Z", "datePublished": "2023-01-10T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-25T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://breakingthe3ma.app"}, {"url": "https://breakingthe3ma.app/files/Threema-PST22.pdf"}, {"url": "https://news.ycombinator.com/item?id=34316206"}, {"url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement"}, {"url": "https://github.com/srikanth-lingala/zip4j/releases"}, {"url": "https://github.com/srikanth-lingala/zip4j/issues/485"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:20:31.194Z"}, "title": "CVE Program Container", "references": [{"url": "https://breakingthe3ma.app", "tags": ["x_transferred"]}, {"url": "https://breakingthe3ma.app/files/Threema-PST22.pdf", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=34316206", "tags": ["x_transferred"]}, {"url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement", "tags": ["x_transferred"]}, {"url": "https://github.com/srikanth-lingala/zip4j/releases", "tags": ["x_transferred"]}, {"url": "https://github.com/srikanth-lingala/zip4j/issues/485", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-09T15:31:09.415636Z", "id": "CVE-2023-22899", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T15:31:44.778Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://breakingthe3ma.app", "tags": ["x_transferred"]}, {"url": "https://breakingthe3ma.app/files/Threema-PST22.pdf", "tags": ["x_transferred"]}, {"url": "https://news.ycombinator.com/item?id=34316206", "tags": ["x_transferred"]}, {"url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement", "tags": ["x_transferred"]}, {"url": "https://github.com/srikanth-lingala/zip4j/releases", "tags": ["x_transferred"]}, {"url": "https://github.com/srikanth-lingala/zip4j/issues/485", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:20:31.194Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-22899", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-09T15:31:09.415636Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-09T15:31:33.313Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://breakingthe3ma.app"}, {"url": "https://breakingthe3ma.app/files/Threema-PST22.pdf"}, {"url": "https://news.ycombinator.com/item?id=34316206"}, {"url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement"}, {"url": "https://github.com/srikanth-lingala/zip4j/releases"}, {"url": "https://github.com/srikanth-lingala/zip4j/issues/485"}], "descriptions": [{"lang": "en", "value": "Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-25T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-22899", "state": "PUBLISHED", "dateUpdated": "2025-04-09T15:31:44.778Z", "dateReserved": "2023-01-10T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-01-10T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zip4j_project:zip4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB7DECD0-B6E1-49CD-A63C-47C38DFE663D", "versionEndIncluding": "2.11.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive."}, {"lang": "es", "value": "Zip4j hasta 2.11.2, como se usa en Threema y otros productos, no siempre verifica la MAC al descifrar un archivo ZIP."}], "id": "CVE-2023-22899", "lastModified": "2025-04-09T16:15:23.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-10T02:15:09.997", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://breakingthe3ma.app"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://breakingthe3ma.app/files/Threema-PST22.pdf"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/srikanth-lingala/zip4j/issues/485"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/srikanth-lingala/zip4j/releases"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "https://news.ycombinator.com/item?id=34316206"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://breakingthe3ma.app"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://breakingthe3ma.app/files/Threema-PST22.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/srikanth-lingala/zip4j/issues/485"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/srikanth-lingala/zip4j/releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://news.ycombinator.com/item?id=34316206"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}