diff --git a/README.md b/README.md index 3a1d2a6..8420e73 100644 --- a/README.md +++ b/README.md @@ -33,4 +33,4 @@ Per the DotNetZip docs, this compression is compatible with the deflate RFC as i Unaffected by DotNetZip directory traversal vulnerability --- -[DotNetZip has a directory traversal vulnerability](https://github.com/advisories/GHSA-xhg6-9j5j-w4vf) when extracting ZipEntry. Unfortunately, [DotNetZip](https://github.com/haf/DotNetZip.Semverd) is no longer maintained and will likely not be updated. However, code using this library (and no other DotNetZip features) is not affected because the library as far as I can tell never touches any code-paths which use ZipEntry; this library only deals with simple byte arrays and never performs any I/O. In short: the vulnerability is in the zip-archive part of DotNetZip, not the Zlib algorithmic part. +[DotNetZip has a directory traversal vulnerability](https://github.com/advisories/GHSA-xhg6-9j5j-w4vf) when extracting ZipEntry. Unfortunately, [DotNetZip](https://github.com/haf/DotNetZip.Semverd) is no longer maintained and will likely not be updated. However, code using this library (and no other DotNetZip features) is not affected because the library as far as I can tell never touches any code-paths which use ZipEntry; this library only deals with simple byte arrays and never performs any I/O. In short: the vulnerability is in the zip-archive part of DotNetZip, not the Zlib algorithmic part. Note that use of this code is at your own risk.