zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
What to do
- Upgrade to a fixed version: zip 9.0.5.
- Redeploy and restart long-running processes so they load the fixed code.
Affected packages
zip
- <= 9.0.4
- 9.0.5
Check your project: cargo tree -i zip
What changed
Published in the GitHub Advisory Database as critical.