Library zlib has vulnerability CVE-2023-45853

[github-actions]

https://nvd.nist.gov/vuln/detail/CVE-2023-45853

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

[Smjert]

osquery is not using or even compiling the MiniZip project, so it's not affected.

[Neustradamus]

Linked to:

• Please release 1.3.1 to fix CVE-2023-45853 (9.8 CRITICAL) madler/zlib#868

[RolfKal]

While the fix looks ok it does have an unnecessary runtime performance penalty by doing strlen() on the filename and comment twice in that function.

[Neustradamus]

@Smjert: The CVE is not fixed in 1.3, please add the separate fix.