#931895 unzip: zip bomb false positives in Java ecosystem

Package:
gradle
Source:
gradle
Submitter:
Ben Caradoc-Davies
Date:
2026-08-11 23:11:01 UTC
Severity:
normal
Tags:
#931895#5
Date:
2019-07-11 23:52:14 UTC
From:
To:
Dear Maintainer,

zip bomb detection introduced in 6.0-24 (see #931433
<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232)
causes unzip to reject many jar files distributed in the Java ecosystem.

Workaround is to downgrade to unzip 6.0-23.

Examples:

$ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq
{} \; 2>&1 | grep -B1 invalid
.gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy-
all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle-
kotlin-dsl-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle-
kotlin-dsl-tooling-builders-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle-
kotlin-dsl-provider-plugins-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy-
all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring-
orm-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring-
orm-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring-
beans-4.3.16.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring-
beans-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring-
beans-4.3.18.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
.m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring-
beans-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
--
java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)

Kind regards,
Ben.

#931895#10
Date:
2019-07-12 01:23:05 UTC
From:
To:
gradle groovy false positive attached (this jar is the groovy bundled
with gradle).

Note that affected jars have been bundled into four separate zip files
to thwart MTA spam filtering (which often rejects all jar files), and
into several emails to avoid MTA size limits.

#931895#15
Date:
2019-07-12 01:30:37 UTC
From:
To:
With the 17 affected jar files in the current working directory:

unzip 6.0-23:

$ for f in *.jar; do echo $f; unzip -tq $f; done
asm-5.0.3-sources.jar
No errors detected in compressed data of asm-5.0.3-sources.jar.
asm-analysis-5.0.3-sources.jar
No errors detected in compressed data of asm-analysis-5.0.3-sources.jar.
asm-tree-5.0.3-sources.jar
No errors detected in compressed data of asm-tree-5.0.3-sources.jar.
asm-util-5.0.3-sources.jar
No errors detected in compressed data of asm-util-5.0.3-sources.jar.
gradle-kotlin-dsl-5.4.1.jar
No errors detected in compressed data of gradle-kotlin-dsl-5.4.1.jar.
gradle-kotlin-dsl-5.5.1.jar
No errors detected in compressed data of gradle-kotlin-dsl-5.5.1.jar.
gradle-kotlin-dsl-provider-plugins-5.4.1.jar
No errors detected in compressed data of
gradle-kotlin-dsl-provider-plugins-5.4.1.jar.
gradle-kotlin-dsl-provider-plugins-5.5.1.jar
No errors detected in compressed data of
gradle-kotlin-dsl-provider-plugins-5.5.1.jar.
gradle-kotlin-dsl-tooling-builders-5.4.1.jar
No errors detected in compressed data of
gradle-kotlin-dsl-tooling-builders-5.4.1.jar.
gradle-kotlin-dsl-tooling-builders-5.5.1.jar
No errors detected in compressed data of
gradle-kotlin-dsl-tooling-builders-5.5.1.jar.
groovy-all-1.0-2.5.4.jar
No errors detected in compressed data of groovy-all-1.0-2.5.4.jar.
spring-beans-4.2.5.RELEASE-sources.jar
No errors detected in compressed data of
spring-beans-4.2.5.RELEASE-sources.jar.
spring-beans-4.3.16.RELEASE-sources.jar
No errors detected in compressed data of
spring-beans-4.3.16.RELEASE-sources.jar.
spring-beans-4.3.18.RELEASE-sources.jar
No errors detected in compressed data of
spring-beans-4.3.18.RELEASE-sources.jar.
spring-beans-4.3.7.RELEASE-sources.jar
No errors detected in compressed data of
spring-beans-4.3.7.RELEASE-sources.jar.
spring-orm-4.2.5.RELEASE-sources.jar
No errors detected in compressed data of
spring-orm-4.2.5.RELEASE-sources.jar.
spring-orm-4.3.7.RELEASE-sources.jar
No errors detected in compressed data of
spring-orm-4.3.7.RELEASE-sources.jar.

unzip 6.0-24:

$ for f in *.jar; do echo $f; unzip -tq $f; done
asm-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
asm-analysis-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
asm-tree-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
asm-util-5.0.3-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-provider-plugins-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-provider-plugins-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-tooling-builders-5.4.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
gradle-kotlin-dsl-tooling-builders-5.5.1.jar
error: invalid zip file with overlapped components (possible zip bomb)
groovy-all-1.0-2.5.4.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-beans-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-beans-4.3.16.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-beans-4.3.18.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-beans-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-orm-4.2.5.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)
spring-orm-4.3.7.RELEASE-sources.jar
error: invalid zip file with overlapped components (possible zip bomb)

Kind regards,

#931895#20
Date:
2019-07-12 01:18:52 UTC
From:
To:
gradle false positives attached.
#931895#25
Date:
2019-07-12 01:16:13 UTC
From:
To:
asm false positives attached .
#931895#30
Date:
2019-07-12 01:17:20 UTC
From:
To:
spring false positives attached.
#931895#35
Date:
2019-07-12 07:41:58 UTC
From:
To:
Hello.

I applied your fix for the zip bomb issue to the Debian unzip package
and shortly afterwards I received this bug report from one of our users
(Ben Caradoc-Davies, in the Cc).

(Note: Our BTS is email-based, but I could also put an issue on github
if you prefer).

The full report is available here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895

Thanks.
----- Forwarded message from Ben Caradoc-Davies <ben@transient.nz> ----- Date: Fri, 12 Jul 2019 11:52:14 +1200 From: Ben Caradoc-Davies <ben@transient.nz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: Bug#931895: unzip: zip bomb false positives in Java ecosystem X-Mailer: reportbug 7.5.2 Package: unzip Version: 6.0-24 Severity: normal Dear Maintainer, zip bomb detection introduced in 6.0-24 (see #931433 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232) causes unzip to reject many jar files distributed in the Java ecosystem. Workaround is to downgrade to unzip 6.0-23. Examples: $ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq {} \; 2>&1 | grep -B1 invalid .gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle- kotlin-dsl-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-tooling-builders-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-provider-plugins-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring- orm-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring- orm-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring- beans-4.3.16.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring- beans-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring- beans-4.3.18.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring- beans-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) Kind regards, Ben.
----- End forwarded message -----
#931895#38
Date:
2019-07-12 07:41:58 UTC
From:
To:
Hello.

I applied your fix for the zip bomb issue to the Debian unzip package
and shortly afterwards I received this bug report from one of our users
(Ben Caradoc-Davies, in the Cc).

(Note: Our BTS is email-based, but I could also put an issue on github
if you prefer).

The full report is available here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895

Thanks.
----- Forwarded message from Ben Caradoc-Davies <ben@transient.nz> ----- Date: Fri, 12 Jul 2019 11:52:14 +1200 From: Ben Caradoc-Davies <ben@transient.nz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: Bug#931895: unzip: zip bomb false positives in Java ecosystem X-Mailer: reportbug 7.5.2 Package: unzip Version: 6.0-24 Severity: normal Dear Maintainer, zip bomb detection introduced in 6.0-24 (see #931433 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931433> and CVE-2019-13232) causes unzip to reject many jar files distributed in the Java ecosystem. Workaround is to downgrade to unzip 6.0-23. Examples: $ find .gradle .m2 java -name "*.jar" -type f -size +0c -print -exec unzip -tq {} \; 2>&1 | grep -B1 invalid .gradle/wrapper/dists/gradle-5.2.1-bin/9lc4nzslqh3ep7ml2tp68fk8s/gradle-5.2.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/gradle- kotlin-dsl-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-tooling-builders-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/plugins/gradle- kotlin-dsl-provider-plugins-5.4.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- .gradle/wrapper/dists/gradle-5.4.1-bin/e75iq110yv9r9wt1a6619x2xm/gradle-5.4.1/lib/groovy- all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-tree/5.0.3/asm-tree-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-util/5.0.3/asm-util-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm/5.0.3/asm-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/ow2/asm/asm-analysis/5.0.3/asm-analysis-5.0.3-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.2.5.RELEASE/spring- orm-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-orm/4.3.7.RELEASE/spring- orm-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.16.RELEASE/spring- beans-4.3.16.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.2.5.RELEASE/spring- beans-4.2.5.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.18.RELEASE/spring- beans-4.3.18.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- .m2/repository/org/springframework/spring-beans/4.3.7.RELEASE/spring- beans-4.3.7.RELEASE-sources.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-tooling-builders-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/plugins/gradle-kotlin-dsl-provider-plugins-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) -- java/gradle-5.5.1/lib/gradle-kotlin-dsl-5.5.1.jar error: invalid zip file with overlapped components (possible zip bomb) java/gradle-5.5.1/lib/groovy-all-1.0-2.5.4.jar error: invalid zip file with overlapped components (possible zip bomb) Kind regards, Ben.
----- End forwarded message -----
#931895#43
Date:
2019-07-12 16:32:53 UTC
From:
To:
Santiago,

Thank you for the report.

I downloaded the four false-positive zip files from the bugreport page, and none of them showed a zip bomb error (or any other error).

How exactly did you apply the fix? Did you download the complete source from github? Or did you try to selectively apply a commit?

Mark

#931895#48
Date:
2019-07-12 16:43:54 UTC
From:
To:
I applied the commits I believed to be the fix for the zipbomb issue, i.e.
these two:

commit 41beb477c5744bc396fa1162ee0c14218ec12213
  Fix bug in undefer_input() that misplaced the input state.
commit 47b3ceae397d21bf822bc2ac73052a4b1daf8e1c
  Detect and reject a zip bomb using overlapped entries.

(The Debian version in turn had already a bunch of other changes to
fix other CVE issues and other misc fixes, I hope there are not
incompatibilities).

Thanks.

#931895#53
Date:
2019-07-12 16:53:40 UTC
From:
To:
Well, apparently there is an incompatibility. I can make no promises about applying those commits to an unzip source of unknown provenance.

Where do I find this source?

#931895#58
Date:
2019-07-12 17:08:58 UTC
From:
To:
I understand, that's why I also contacted Steven Schweda for the
zipbomb issue.

The source is distributed as the original tarball (which you already have)
plus this:

http://deb.debian.org/debian/pool/main/u/unzip/unzip_6.0-24.debian.tar.xz

[ We use quilt here. Patches are in debian/patches and they are applied
  sequentially in the order stated by debian/patches/series ].

Thanks.

#931895#63
Date:
2019-07-12 22:22:17 UTC
From:
To:
Mark,

the zip bomb error is seen when unzipping the 17 jar files contained
within the four zip files. Did you test these inner jar files? I used
(in bash):

$ for f in *.jar; do echo $f; unzip -tq $f; done

The outer zip files are there because many email filters block all email
with jar attachments, and Debian BTS is email-based.

It would also be nice if unzip reported the filename when rejecting a
suspected zip bomb, as it does when reporting "No errors detected".

Kind regards,

#931895#68
Date:
2019-07-13 03:23:15 UTC
From:
To:
Ben,

Ah, no, I did not test the jar files. I just did, and indeed I am seeing the reported zip bomb detections.

Thanks. I’ll look into it.

Mark

#931895#73
Date:
2019-07-16 22:26:42 UTC
From:
To:
All,

Ok, I looked into it. Those jar files are seriously messed up. Any self-respecting unzipper would be well within its rights to reject them as invalid. As it turns out, my patch to unzip is doing exactly what it’s supposed to. Something that processed those jar files has a bug.

In each of those .jar files there are several entries that are duplicated in a screwy way. First, those entries each have an exactly duplicated central directory entry, with the same file name, pointing to the same local header offset in the jar file. You can see this even using an unpatched unzip, asking it to unzip the jar file. It will extract a bunch of files, and then ask you if you’d like to replace a file it just unzipped when it encounters the duplicated central directory entry.

The fact that two central directory entries are pointing to the same local header is what is, rightly, setting off the zip bomb detection in the patched unzip.

Second, the other screwy thing is that there are a bunch of vestigial blocks of data in those jar files that are not referred to by any central directory entry. I presume that those are the data for those same files that were intended to be pointed to by the duplicated central directory entries, but were orphaned when the offsets to the local headers were not changed for those entries. Of course, even if the offsets had been changed so that all the data in the jar file were actually used, it would still be invalid due to having the same names appear more than once.

The bug that resulted in these jar files might be even more serious if the duplicated entries are pointing to a previous version of those entries, and what was intended was to update those entries to what is now in the orphaned vestigial regions. Hopefully that’s not that the case.

In summary, those jar files are grossly invalid zip files for three reasons: 1. The same name appears twice, 2. Two central directory entries point to the same local header (setting off zip bomb detection), and 3. There is an orphaned chunk of the file that is not referred to by any central directory header.

As one example, all three of those things each occur 115 times in asm-5.0.3-sources.jar, out of 261 original central directory entries. Were it to be fixed, that jar file would have 146 unique entries, and would be quite a bit smaller. Which in addition to being invalid is also unfortunate and inefficient, since compression is kinda the point of the zip format.

Mark

#931895#78
Date:
2019-07-17 15:01:38 UTC
From:
To:
Thanks a lot, Mark, for such a comprehensive reply!

I'll ask the submitter where exactly those files come from,
but there is indeed little to do on my side.

Thanks.

#931895#83
Date:
2019-07-17 15:05:50 UTC
From:
To:
Hi.

According to Mark Adler, those jar files are buggy:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#73

Simple question: Do those jar files come from any package that we
(Debian) distribute? If yes, I'd like to reassign the bug. If not, I
guess closing the bug as "not really a bug" is the only sensible thing to do.

Thanks.

#931895#90
Date:
2019-07-18 01:11:14 UTC
From:
To:
Mark, thanks very much for your detailed analysis.

Santiago,

none of these jar files come from Debian. They are sourced from Maven
Central, Gradle repositories, and the official Gradle binary distribution.

I checked all the jar files included in Debian gradle 4.4.1-7,
libgradle-core-java 4.4.1-7, and libgradle-plugins-java 4.4.1-7, with
unzip 6.0-24 (zip bomb detection included) and no errors were detected.

This bug may be of interest to the Debian gradle maintainers if they
think any future upstream fix is suitable for backport, but if not, this
bug should be closed as it does not seem to affect the version of Gradle
in Debian sid (4.4.1-7). Please reassign or close as you see fit.

Given that the affected jars are all built with Gradle, and that the
current stable Gradle release (5.5.1) includes several affected jars
themselves built with Gradle, the problem is likely in Gradle, or the
JDK itself. In any case, the Gradle project are best positioned to
investigate.

I have forwarded this bug upstream to the Gradle project:

Gradle jars "grossly invalid zip files" that trigger zip bomb detection
[CVE-2019-13232]
https://github.com/gradle/gradle/issues/9990

Kind regards,

#931895#101
Date:
2019-08-03 10:13:37 UTC
From:
To:
Dear gradle maintainers:

I've reassigned this bug to gradle after hearing the explanations from
both Mark Adler here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#73

and the bug submitter here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931895#90

Thanks.

#931895#106
Date:
2026-03-30 06:13:28 UTC
From:
To:
Hola amigo, por favor entiende que nuestras ONG, organizaciones requieren tu atención para que puedas gestionar un proyecto de desarrollo humanitario en tu ciudad valorado en (8.370.000,00  AC) por un período de 3 años.
Contáctenos para obtener más información si está interesado y puede administrar un proyecto de programa de desarrollo humanitario dedicado a apoyar a niños en dificultades, pequeños empresarios y mujeres con los fondos mencionados anteriormente.
Asegúrese de que todas sus respuestas se envíen directamente a esta dirección de correo electrónico privada únicamente en: ( info@globalcbm.online  )
Esperamos sus respuestas.

#931895#111
Date:
2026-08-11 23:08:05 UTC
From:
To:
Saludos desde el imperio de la élite mundial Illuminati. Llevamos a los pobres, necesitados y talentosos a la fama, la riqueza, el poder, el conocimiento y las conexiones empresariales y políticas. ¡Este es el momento perfecto para que pongas fin a todas tus preocupaciones, problemas de salud y dificultades financieras uniéndote a la familia de élite Illuminati! ¿Estás enfermo, tienes problemas de fertilidad o divorcio, o te resulta difícil conseguir ascensos en tu trabajo para alcanzar el éxito que deseas en la vida? Si es así, únete al imperio Illuminati y obtendrás numerosos beneficios y soluciones a tus problemas.

Nota: Este correo electrónico se creó únicamente para nuestro programa de reclutamiento, que finaliza el próximo mes. Esta oferta es exclusiva para personas con un perfil único. Si no estás realmente interesado en unirte al imperio Illuminati, te recomendamos no contactarnos. La deslealtad no se tolera en nuestra organización.

¿Aceptas ser miembro del nuevo orden mundial Illuminati? Si es así, Por favor, respóndanos únicamente a nuestro correo electrónico de reclutamiento: info@illuminatiinvite.online
Tenga en cuenta que todas sus respuestas deben enviarse directamente a la dirección de correo electrónico mencionada anteriormente: info@illuminatiinvite.online
Para obtener más información sobre nuestro proceso de membresía, contáctenos.
Nota: Algunos proveedores de correo electrónico colocan incorrectamente los mensajes oficiales de los Illuminati en la carpeta de spam/correo no deseado o en la carpeta de promociones. Esto puede provocar que no reciba nuestras respuestas.
Los Illuminati.