CVE catalog

CVE-2023-22899

zip4j: CVE-2023-22899

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.64% · Oct 27, 2026

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzip4jsid2.11.6-1fixed
Debianzip4jforky2.11.6-1fixed
Debianzip4jtrixie2.11.5-1fixed
Debianzip4jbookworm2.11.5-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzip4jsourcesid2.11.2-3not yet assignedNot reported[1029038]
Debianzip4jsourceforky2.11.2-3not yet assignedNot reported[1029038]
Debianzip4jsourcetrixie2.11.2-3not yet assignedNot reported[1029038]
Debianzip4jsourcebookworm2.11.2-3not yet assignedNot reported[1029038]

[Debian bug #1029038]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libzip4j-java]Fixed

    Source package: [zip4j]

    Details (2)

    • 2.11.5-1 · all · bookworm

      Fixed · Fixed: 2.11.2-3

      dsa · zip4j · debian · bookworm; dsa · zip4j · debian · 12

    • 2.11.5-1 · all · bookworm

      Fixed · Fixed: 2.11.2-3

      dsa · zip4j · debian · bookworm; dsa · zip4j · debian · 12

[Debian 13 (Trixie)]

  • [libzip4j-java]Fixed

    Source package: [zip4j]

    Details (2)

    • 2.11.5-1 · all · trixie

      Fixed · Fixed: 2.11.2-3

      dsa · zip4j · debian · 13

    • 2.11.5-1 · all · trixie

      Fixed · Fixed: 2.11.2-3

      dsa · zip4j · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]