AE-2 Encryption Bypass in pyzipper

Executive Summary

This vulnerability is in pyzipper, a Python library for handling AES encrypted ZIP files. Due to a bug, encrypted files were always saved in the weaker AE-1 format instead of the more secure AE-2 format. This exposed the plaintext CRC32 checksum in the ZIP header and data descriptor, allowing attackers to brute-force small or low-entropy files by comparing CRC32 values.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses pyzipper versions prior to 0.4.0. Run: pip show pyzipper. If the version is below 0.4.0, the system is vulnerable. Inspect ZIP archives created with pyzipper for unencrypted CRC32 checksums in headers or data descriptors.

Useful 0 Not Useful 0

Impact Analysis

If you use pyzipper versions before 0.4.0 to encrypt small or low-entropy files, an attacker who obtains the encrypted ZIP file could potentially recover the original plaintext by brute-forcing CRC32 checksums. This risks unauthorized access to sensitive data in those files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes plaintext CRC32 checksums in encrypted ZIP archives, allowing brute-force attacks on small or low-entropy files. For compliance standards like GDPR or HIPAA, which require protection of sensitive data, this could lead to unauthorized access to encrypted content, violating confidentiality requirements and potentially resulting in non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade pyzipper to version 0.4.0 or later using: pip install --upgrade pyzipper. Recreate any ZIP archives created with vulnerable versions to remove exposed CRC32 checksums. Avoid using vulnerable versions for encrypting sensitive files.

Useful 0 Not Useful 0