CyberRota Analysis
AI-GeneratedThe pyzipper library, used for handling AES encrypted zip files, contains a vulnerability that affects versions prior to 0.4.0, where a Python operator precedence bug prevents the secure AE-2 encryption format from being utilized. This flaw exposes the plaintext CRC32 checksum in the ZIP header, enabling attackers to potentially brute-force low-entropy files. Organizations utilizing pyzipper for encryption should prioritize upgrading to version 0.4.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1 format and exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.