[From nobody Wed Oct 28 05:01:09 2026 Received: (at submit) by bugs.debian.org; 26 Oct 2026 21:42:35 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 45; hammy, 150; neutral, 141; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:45814) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xLSSi-0096IY-0z for submit@bugs.debian.org; Mon, 26 Oct 2026 21:42:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=L8JWjLvHWJ2jiAPHwLQLJ/Qhsy/udxB7xgsnubCxbMM=; b=jUAvoyosXYtXAbFG8lycHi1n0L F2pSh8gszi5ib87c17J2gtEsGByM5ci/pZTOc1JYxXZTF+eaztZR4oDv3KduWMW8Z+EXIaWB78h9n zP8+x0jQxCtKTegbEjsVdx0QMOxISDIk571nJAaEIlQD7OGJl2BAJVyvNmhtngOUlREb1DzAFdhYn db/G15V7UUEOMBF1plJEGWaztv598OuT/6F9k2mDZIWCRaa2YUr8pRe2mRnRyPA+XZrvHywejif76 xLFFikI30ja3QHL2ic+Fs8YfjcaOiyV2wprNkp0pxQj9xBHifodBKEwzYv60pdJw26960OAv2szYg uhDQbJUA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xLSSf-000ylW-17 for submit@bugs.debian.org; Mon, 26 Oct 2026 21:42:34 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id 92F08DC038C; Mon, 26 Oct 2026 22:42:32 +0100 (CET) Date: Mon, 26 Oct 2026 22:42:32 +0100 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: rust-zip: CVE-2026-115905 CVE-2026-115906 CVE-2026-115907 CVE-2026-115909 Message-ID: <at_JSNNj04fZswtZ@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: rust-zip Version: 5.1.1+dfsg-1 X-Debbugs-CC: team@security.debian.org Severity: grave Tags: security upstream Hi, The following vulnerabilities were published for rust-zip. CVE-2026-115905[0]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory | File Header filenames as authoritative while ZipStreamReader | extracts using Local File Header filenames without reconciling the | duplicate metadata in src/read/stream.rs. A crafted archive can | therefore appear benign to a component that inspects the central | directory but cause a streaming extractor to write a different | attacker-selected path and content, potentially overwriting files | used by a downstream service. This issue is fixed in version 9.0.5. CVE-2026-115906[1]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 0.6.0 until 9.0.0, the AES entry reader in | src/aes.rs verifies its HMAC only when the attacker-controlled data | counter reaches zero. If the underlying bounded reader reaches the | real end of the archive while data_remaining is still positive, or | if an encrypted entry has no payload, the reader can return a clean | end of stream without reading and comparing the authentication tag. | Applications using by_index_decrypt, by_name_decrypt, | by_path_decrypt, or password-enabled by_index_with_options can | therefore accept modified plaintext without an authentication error. | This issue is fixed in version 9.0.0. CVE-2026-115907[2]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 5.1.0 until 9.0.0, applications built with | the legacy-zip feature can reserve output capacity from an attacker- | controlled ZIP64 uncompressed size before validating the compressed | stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic | with a capacity overflow during ZipArchive::extract, and the Reduce | and Implode decoders contain the same unbounded preallocation | pattern. An unhandled panic can terminate an archive-processing | service. This issue is fixed in version 9.0.0. CVE-2026-115909[3]: | zip is a zip library for Rust that supports reading and writing | simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in | src/read/mod.rs calls Vec::with_capacity for a symbolic link target | using the attacker-controlled ZIP64 uncompressed_size before reading | entry data. A small archive can request an impossible capacity, | causing the infallible allocation path to abort the process before | the entry is validated. The failure cannot be contained with | catch_unwind or a worker thread, allowing repeated denial of service | in archive-processing applications. This issue is fixed in version | 9.0.0. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-115905 https://www.cve.org/CVERecord?id=CVE-2026-115905 [1] https://security-tracker.debian.org/tracker/CVE-2026-115906 https://www.cve.org/CVERecord?id=CVE-2026-115906 [2] https://security-tracker.debian.org/tracker/CVE-2026-115907 https://www.cve.org/CVERecord?id=CVE-2026-115907 [3] https://security-tracker.debian.org/tracker/CVE-2026-115909 https://www.cve.org/CVERecord?id=CVE-2026-115909 Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]