Security issues with p7zip

p7zip has some active CVEs.  I see we’re already carrying some of the patches for p7zip:
* [CVE-2016-9296](https://github.com/JuliaLang/julia/blob/bb5b98e72a151c41471d8cc14cacb495d647fb7f/deps/patches/p7zip-12-CVE-2016-9296.patch)
* [CVE-2017-17969](https://github.com/JuliaLang/julia/blob/bb5b98e72a151c41471d8cc14cacb495d647fb7f/deps/patches/p7zip-13-CVE-2017-17969.patch)

But I think we need patches for
* [CVE-2018-5996](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5996)
* [CVE-2018-10115](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10115)
* ~~[CVE-2022-29072](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29072)~~

The upstream [p7zip project](https://sourceforge.net/projects/p7zip/) seems to be [fairly abandoned](https://sourceforge.net/p/p7zip/discussion/383043/thread/fa143cf2/), with lots of conflicting information about the latest release. There is a fork of p7zip carries ([at least some](https://github.com/jinfeihan57/p7zip/pull/11)) of those patches.  NixOS has switched to that fork: https://github.com/NixOS/nixpkgs/issues/88147

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security issues with p7zip #45397

mbauman
openedon May 20, 2022

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Security issues with p7zip #45397

Description

mbaumanopenedon May 20, 2022

Metadata