runzip: mark package as insecure (#513544)

2026-04-27 07:33:55 +00:00
parent 111e511123 f654908dfc
commit 5d898d4d11
1 changed files with 5 additions and 0 deletions
@@ -41,6 +41,11 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Tool to convert filename encoding inside a ZIP archive";
    license = lib.licenses.bsd2;
    maintainers = [ lib.maintainers.raskin ];
+    # runzip vendors libzip 0.7.1.
+    knownVulnerabilities = [
+      "CVE-2015-2331"
+      "CVE-2017-14107"
+    ];
    platforms = lib.platforms.unix;
    mainProgram = "runzip";
  };