This is what I truly don't like about the CVE system.

One such example is CVE-2023-45853 [1]. Zlib included in it's source an extra set of utilities and add-ons. One such utility, MiniZip, had a buffer overflow vulnerability. BAM, 8.8 CVE (was a 9, looks like they pulled it back a bit). But not one that the 99% of applications using zlib would ever be vulnerable to because almost nobody used the MiniZip utility. It was so unused that the solution for zlib was to simply remove it.

I know about this one particularly because our security policy required us to do a BUNCH of pointless updates for it since zlib is in just about everything.

[1] https://app.opencve.io/cve/CVE-2023-45853

▲ stabbles 37 minutes ago | parent | next [-]

In the Spack package manager [1] we're trying to work around this with directives:

    deprecated("@:1.3 +minizip", reason="cve", severity="high")

So, you can define conditional deprecation, and the dependency resolver can still pick up `zlib ~minizip` (i.e. with a variant/component disabled).

Deprecation on versions only isn't the right granularity.

[1]: https://github.com/spack/spack/pull/52372

▲ post-it 42 minutes ago | parent | prev | next [-]

But could an attacker with access to zip tools exploit it to get a root shell? Probably not, but maybe.

	▲	cogman10 36 minutes ago \| parent \| next [-]
		Well that's the thing, to build the utilities required extra flags which were pretty rarely enabled. You can, in most distros, ultimately install minizip as a separate package but few do. It's not that useful of a utility. Most people will likely just grab the full blown "zip" application https://infozip.sourceforge.net/Zip.html . Though on linux, even more people are simply using tar with a zlib extension. That's the `tar.gz` files.
	▲	PunchyHamster 13 minutes ago \| parent \| prev [-]
		if the tool isn't ran it can't be exploited CVE should just be far more granular instead of flagging alert for anything using zlib

▲ dncornholio 32 minutes ago | parent | prev [-]

If the solution was to remove an unused dependency, I think this CVE isn't silly at all.