Choco: RAR extraction with older 7zip can cause memory corruption (CVE-2018-5996) / ZIP Shrink vulnerability (CVE-2017-17969)

[ferventcoder]

• https://groups.google.com/d/msgid/chocolatey/3efeec42-333c-44c7-a99e-1d3f0ff1e94a%40googlegroups.com
• https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
• http://7-zip.org/
• https://sourceforge.net/p/sevenzip/discussion/45797/thread/628149a0/

[ferventcoder]

Workaround

~~~powershell

Ensure we can run everything

Set-ExecutionPolicy Bypass -Scope Process -Force

try
{
}
catch
{
Write-Warning "This may fail, if you see TLS errors, please download manually."
}

Download files

Invoke-WebRequest -UseBasicParsing -Uri https://cdn.rawgit.com/chocolatey/choco/1f8024c102cebe0cf2628cdab4e322416376036c/src/chocolatey.resources/tools/7z.exe -UseDefaultCredential -OutFile "$env:ChocolateyInstall\tools\7z.exe"
Invoke-WebRequest -UseBasicParsing -Uri https://cdn.rawgit.com/chocolatey/choco/1f8024c102cebe0cf2628cdab4e322416376036c/src/chocolatey.resources/tools/7z.dll -UseDefaultCredential -OutFile "$env:ChocolateyInstall\tools\7z.dll"
~~~

[brandonh-msft]

Got the e-mail alert for this, but I can't upgrade to 0.10.9 via -pre:
~
PS C:\WINDOWS\system32> cup chocolatey chocolatey.extension -y -pre
Chocolatey v0.10.8 Professional
Upgrading the following packages:
chocolatey;chocolatey.extension
By upgrading you accept licenses for the packages.
chocolatey v0.10.8 is the latest version available based on your source(s).
chocolatey.extension v1.12.11 is the latest version available based on your source(s).
~

[marcinbojko]

Same here, on this end.

[ferventcoder]

Howdy folks - https://chocolatey.org/packages/chocolatey/0.10.9-beta-20180223 is still in moderation.

It will automatically approve in the next half hour to an hour - choco upgrade chocolatey -y -pre --version 0.10.9-beta-20180223 should get you it immediately.

[marcinbojko]

Magic works, thanks for the heads up. With puppet it will be a breeze ;)