What is CVE-2023-31102?
CVE-2023-31102 is a high-severity vulnerability affecting the PPMD codec of the 7-Zip software, specifically in the Ppmd7.c file. This vulnerability is present in 7-Zip versions prior to 23.00 and can lead to an integer underflow and invalid read operation via a crafted 7Z archive. Systems running 7-Zip software on Linux, NetApp Active IQ Unified Manager on Windows, and NetApp OnCommand Workflow Automation are among the types of systems affected by this vulnerability.
Who is impacted by CVE-2023-31102?
Users of 7-Zip software on Linux, as well as NetApp Active IQ Unified Manager and OnCommand Workflow Automation, are affected by the CVE-2023-31102 vulnerability. This issue impacts all 7-Zip versions up to and excluding 23.00. The vulnerability can lead to the disclosure of sensitive information, addition or modification of data, or even denial of service when exploited. It is essential for users to be aware of this vulnerability and update their software to a secure version.
What to do if CVE-2023-31102 affected you
If you're affected by the CVE-2023-31102 vulnerability, it's crucial to update your software to mitigate potential risks. Follow these simple steps:
Update 7-Zip to version 23.00 or later. Download the latest version from the 7-Zip download page.
For NetApp products, refer to the NetApp Product Security advisory and follow their recommendations.
Regularly update your software to ensure the latest security patches are applied.
Is this in CISA’s Known Exploited Vulnerabilities Catalog?
The CVE-2023-31102 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue affects 7-Zip software versions prior to 23.00 and can lead to sensitive information disclosure, data modification, or denial of service. To address this vulnerability, users should update their software to the latest secure version, such as 7-Zip 23.00 or later.
Weakness Enumeration
The weakness enumeration for this vulnerability is categorized as CWE-191, which is an integer underflow issue in the PPMD codec of the 7-Zip software.
Learn More
For a comprehensive understanding of this vulnerability, consult the NVD page and the resources listed below.
