CVE-2022-23596
High
Description
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
SeverityHigh
CVSS7.5
Exploit probability—
ProductJunrar
PublishedFeb 1, 2022
First seenFeb 1, 2022
Weakness typeCWE-835CWE-835
How to fix
Update
- junrar_project junrar7.4.1 or later
- com.github.junrar:junrar7.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| junrar_project junrar | v < 7.4.1 | 7.4.1 |
| com.github.junrar:junrarMaven | v < 7.4.1 | 7.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.