Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade to 7-Zip 16.02 to overcome security vulnerabilities #812

Closed
ferventcoder opened this issue Jun 18, 2016 · 3 comments
Closed

Upgrade to 7-Zip 16.02 to overcome security vulnerabilities #812

ferventcoder opened this issue Jun 18, 2016 · 3 comments
Assignees
@ferventcoder
Labels
5 - Released Improvement Security
Milestone
0.9.10.1

Comments

@ferventcoder
Copy link
Member

ferventcoder commented Jun 18, 2016 •
edited
Loading

Upgrade to 7-Zip 16.02 to overcome CVE-2016-2334/CVE-2016-2335.

Related to #775.
@ferventcoder ferventcoder added this to the 0.9.10.1 milestone Jun 18, 2016
@ferventcoder ferventcoder self-assigned this Jun 18, 2016
@ferventcoder ferventcoder changed the title Upgrade 7-Zip to most up to date version Upgrade to 7-Zip 16.02 to overcome CVE-2016-2334/CVE-2016-2335 Jun 18, 2016
@ferventcoder ferventcoder changed the title Upgrade to 7-Zip 16.02 to overcome CVE-2016-2334/CVE-2016-2335 Upgrade to 7-Zip 16.02 to overcome security vulnerabilities Jun 18, 2016
ferventcoder added a commit that referenced this issue Jun 19, 2016
@ferventcoder
(GH-812) Upgrade 7zip to 16.02 to address CVEs
c3b427c 
Upgrade 7zip to overcome CVE-2016-2334/CVE-2016-2335.

* http://blog.talosintel.com/2016/05/multiple-7-zip-vulnerabilities.html
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2334
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2335
ferventcoder added a commit that referenced this issue Jun 19, 2016
@ferventcoder
Merge branch 'stable'
fc1c895 
* stable:
  (version) 0.9.10.2
  (doc) update CHANGELOG/nuspec
  (GH-758) Ensure log path exists
  (GH-813) Fix double chocolatey logging folder
  (GH-813) Shorten Template default log path
  (doc) update default options help messages
  (maint) Don't log creation of folder
  (maint) formatting / add message consistency
  (GH-814) Ensure any version of choco
  (GH-811) Skip resource / licensed assemblies
  (version) 0.9.10.1
  (doc) update CHANGELOG/nuspec
  (GH-810) Install of choco sets exit code
  (GH-812) Upgrade 7zip to 16.02 to address CVEs
  (doc) Note functions Calling Set-PowerShellExitCode
  (GH-810) Fix - Cannot bind parameter exitCode
@ferventcoder
Copy link
Member Author

ferventcoder commented Jun 20, 2016 •
edited
Loading

If you cannot upgrade to at least 0.9.10.1, you can manually patch your Chocolatey installation. Look in $env:ChocolateyInstall\tools and replace 7za.exe with 16.02. This can be found at https://www.7-zip.org/a/7z1602-extra.7z

In really old installs of Chocolatey (0.9.8.x and below), that path is $env:ChocolateyInstall\chocolateyInstall\tools.

@ferventcoder ferventcoder mentioned this issue Jun 20, 2016
Closed
@ferventcoder
Copy link
Member Author

There are some reports that the newer version of 7za.exe breaks some existing packages. Something to keep in mind. We determined it would be better to be secure and have some breakages versus the alternative.

@ferventcoder
Copy link
Member Author

We are looking to switch over to 7z.exe (full) in 0.9.10.3, which could resolve this entirely.

@ferventcoder ferventcoder mentioned this issue Jun 22, 2016
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ferventcoder ferventcoder

Labels
5 - Released Improvement Security
Projects
None yet
Milestone
0.9.10.1
Development

No branches or pull requests
2 participants
@ferventcoder @gep13