Threats tagged 'ghsa-8hxf-qr8p-62x4'

A vulnerability in the zip crate's AES-encrypted entry handling allows an attacker to bypass HMAC authentication if the entry's declared compressed size exceeds the actual data length, causing premature EOF. This results in truncated, unauthenticated plaintext being accepted without error. Zero-payload entries also bypass authentication. The flaw affects versions from 0.6.0 up to but not including 9.0.0 and is fixed in version 9.0.0.