zip: AES Entry HMAC Authentication Bypass on Premature EOF
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 9.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The zip crate, a Rust library for reading and writing ZIP archives, is affected when applications use its AES-encrypted entry readers (such as by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-protected by_index_with_options). A crafted or truncated encrypted archive can cause these readers to return decrypted data without verifying its authentication tag, allowing modified content to be accepted as valid without any error.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in src/aes.rs verifies its HMAC only when the attacker-controlled data counter reaches zero. If the underlying bounded reader reaches the real end of the archive while data_remaining is still positive, or if an encrypted entry has no payload, the reader can return a clean end of stream without reading and comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can therefore accept modified plaintext without an authentication error. This issue is fixed in version 9.0.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- zip-rs zip2
From 0.6.0 · fixed in 9.0.0
- zipcrates.io
From 0.6.0 · fixed in 9.0.0