MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | pyminizip (PyPI) | up to 0.2.6 | — | No fix listed | GHSA-mq29-j5xf-cjwr |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- pyminizip (PyPI) Vendor— Affected up to 0.2.6 Fixed in — No fix listed GHSA-mq29-j5xf-cjwr
Remediation
Red Hat 1 advisory
- RHSA-2023:7626 Released 2023-12-07 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of OpenJDK 1.8 | Affected | No fix planned: Will not fix |
| Red Hat build of OpenJDK 11 | Affected | No fix planned: Will not fix |
| Red Hat build of OpenJDK 17 | Affected | No fix yet |
| Red Hat JBoss Core Services | Fixed | RHSA-2023:7626 |
Not affected: 4 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift GitOps
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45853
- 2026-10-03 Alias added: GHSA-mq29-j5xf-cjwr
- 2026-10-09 Fix available: RHSA-2023:7626 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Patch 3
Advisory 4
Other 9
- https://www.winimage.com/zLibDll/minizip.html
- https://github.com/madler/zlib/blob/ac8f12c97d1afd9bafa9c710f827d40a407d3266/contrib/README.contrib#L1-L4
- [oss-security] 20231020 CVE-2023-45853: overflows in MiniZip in zlib through 1.3
- https://pypi.org/project/pyminizip/#history
- [oss-security] 20240124 Re: CVE-2023-45853: overflows in MiniZip in zlib through 1.3
- https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c
- https://github.com/smihica/pyminizip
- https://github.com/smihica/pyminizip/blob/master/zlib-1.2.11/contrib/minizip/zip.c
- https://security.netapp.com/advisory/ntap-20231130-0009
Sources
- CVE-2023-45853 · CVE Program
- CVE-2023-45853 · NVD
- FIRST EPSS
- GHSA-mq29-j5xf-cjwr · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45853 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences