CVE-2023-22899

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

CVSS v3.1 NVD

5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.62% chance of exploitation in the next 30 days, 49th percentile

Published

2023-01-10

Updated

2025-04-09

Proof-of-concept exploits (1)

• https://breakingthe3ma.app/files/Threema-PST22.pdf

Security advisories

• https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement
• https://breakingthe3ma.app
• srikanth-lingala/zip4j/issues/485
• https://news.ycombinator.com/item?id=34316206
• advisories/GHSA-2pj2-gchf-wmw7

References

• CVE Record
• NVD entry