minizip in zlib 1.2.13 has a vulnerability
Open
- Dominant language
- C++
- Stars
- 262
- Forks
- 110
- PR merge metrics
- No merged PRs in 30d
Description
According to [**CVE-2024-45853**](https://www.cve.org/CVERecord?id=CVE-2023-45853) `minizip` has a security vulnerability.
`XMP-Toolkit-SDK` requires `zlib`'s version **1.2.13** which has the same vulnerability. `zlib` version **1.3.1** addresses the
same.
Contributor guide
Research direction
No source file, dependency manifest, or test is named. Start by locating where XMP-Toolkit-SDK pins or packages zlib 1.2.13, then check the supported build paths and existing dependency tests. Done means the project uses zlib 1.3.1 or later and the relevant builds and tests pass without the reported minizip vulnerability.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100