New Update 7-Zip version 22.00 released

[silversurfer]

Contains the latest version a fix for vulnerability CVE-2022-29072?

GitHub - kagancapar/CVE-2022-29072: 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. - kagancapar/CVE-2022-29072

github.com

I am sorry for being very late to reply, but today, I found some info about your question, looks like no fix included yet in latest version 22.00

• CVE-2022-29072 not fixed yet

The source article below sounds harsh... I don't know what is true or partially true

Boycott 7-zip: "Limited" Open Source & Security Issues

"Limited" Open Source 7-zip developed by Igor Pavlov, first release happened in far 1999. Licensed under LGPL-2.1-or-later, but one detail: you can't find the actual sources on Github, Gitlab, nor any public code hosting, only src.7z on official Sourceforge page. No history, no committers, no...

nixsanctuary.com

---

About that misguided call for a 7-Zip boycott

It's good to highlight some alternatives, but security issues are overblown

www.theregister.com

 

[Zartarra]

I am sorry for being very late to reply, but today, I found some info about your question, looks like no fix included yet in latest version 22.00

The source article below sounds harsh... I don't know what is true or partially true

Boycott 7-zip: "Limited" Open Source & Security Issues

"Limited" Open Source 7-zip developed by Igor Pavlov, first release happened in far 1999. Licensed under LGPL-2.1-or-later, but one detail: you can't find the actual sources on Github, Gitlab, nor any public code hosting, only src.7z on official Sourceforge page. No history, no committers, no...

nixsanctuary.com

---

About that misguided call for a 7-Zip boycott

It's good to highlight some alternatives, but security issues are overblown

www.theregister.com

@silversurfer ,

Thanks for all the information.

 

[Gandalf_The_Grey]

7-Zip 22.01 was released.

Download​

7-Zip for 64-bit Windows x64:
https://7-zip.org/a/7z2201-x64.exe

7-Zip for 32-bit Windows x86:
https://7-zip.org/a/7z2201.exe

7-Zip for 64-bit Windows ARM64:
https://7-zip.org/a/7z2201-arm64.exe

What's new after 7-Zip 22.00:​

• UDF support was improved to UDF version 2.60.
• HFS and APFS support was improved.

7-Zip / Discussion / Open Discussion: 7-Zip 22.01

sourceforge.net

 

[Local Host]

I am sorry for being very late to reply, but today, I found some info about your question, looks like no fix included yet in latest version 22.00

The source article below sounds harsh... I don't know what is true or partially true

Boycott 7-zip: "Limited" Open Source & Security Issues

"Limited" Open Source 7-zip developed by Igor Pavlov, first release happened in far 1999. Licensed under LGPL-2.1-or-later, but one detail: you can't find the actual sources on Github, Gitlab, nor any public code hosting, only src.7z on official Sourceforge page. No history, no committers, no...

nixsanctuary.com

---

About that misguided call for a 7-Zip boycott

It's good to highlight some alternatives, but security issues are overblown

www.theregister.com

That website is spreading false information however, the source of 7z is publicly available, 7-Zip - Browse Files at SourceForge.net

You can download 7z from direct links in the official website too, regardless, 7z was never packed with bundleware, always been a simple setup file that extracts 7z.

SourceForge is a legit website that developers been using for decades to share their files and sources (this was long before GitHub even existed).

CVE-2022-29072 is false and was confirmed by multiple specialists is not a real exploit (you can see it was dispusted), the guy who leaked it is pretty much known as fraud.

CVE-2018-5996 which he also claims is still an issue in 7z, was patched back in version 18 (same year exploit was revealed).

It's clear that guy is just looking to advertise PeaZip, none of his arguments pan out and is full of misinformation, this type of toxic behaviour just makes me wanna use PeaZip less.

 

[M4RT1NE2]

I currently use BandiZip