[NIFI-9732] Upgrade Zip4j to 2.9.1

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.14.0, 1.15.3
• Fix Version/s: 1.16.0
• Labels: dependency-upgrade security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 26/Feb/22 14:55
• Updated: 27/Feb/22 11:10
• Resolved: 27/Feb/22 11:10

Description

Zip4j prior to 2.9.1 can throw an uncaught exception when parsing crafted Zip files as described in CVE-2022-24615. The UnpackContent processors uses Zip4j to read encrypted Zip files when configured with password.

Issue Links

• links to: GitHub Pull Request #5811