CVE-2022-36943 - lack of sanitization on paths which are symlinks

[speedoholic]

Steps to reproduce

GHSA-vgvw-6xcf-qqfc

Expected behavior

Symlinks which are not relative to the destination path should be ignored unless the user explicitly requests it.

Actual behavior

An attacker can embed a symlink in a ZIP archive pointing to a location of their choosing as the first file in the archive to first create the symlink. If a regular file in the ZIP has the same name as the symlink, the library will open and implicitly follow the symlink using an fopen() call, and the contents of the file are written to the symlink target.

Version of ZipArchive

<=2.5.3

[jhudsonWA]

Fixed in 2.5.4

[anton-patrushev]

Are there any plans to fix this vulnerability for releases before 2.5.0?

As far as I know, there were introduced breaking changes with iOS 15+ as the minimal supported system OS version starting from the 2.5.0 release. It blocks me from fixing the vulnerability due to minimal OS version requirements since I cannot upgrade the package version.

cc: @jhudsonWA

[jhudsonWA]

No. #692

[Coeur]

You may fork the project and attempt to lower the OS version requirements, but we're not supporting that ourselves.