advisory GHSA-gmq8-994r-jv83 - affected version should only be 3.2.0

[alexsch01]

version 3.2.0 of yauzl was the first to have the while loop code inside of Entry.prototype.getLastModDate

---

GHSA-gmq8-994r-jv83

Currently
Affected versions
< 3.2.1

Should be
Affected versions
3.2.0

---

this is version 3.1.3 of yauzl - https://github.com/thejoshwolfe/yauzl/blob/b15f865c219536693108f13266bbd9d658fd6f66/index.js#L592-L594

[MikeMcC399]

https://www.codeant.ai/security-research/yauzl-denial-of-service-zip-file-crash states that the vulnerability was introduced in 3.2.0, so the advisory is incorrect

[MikeMcC399]

See also https://github.com/thejoshwolfe/yauzl/blob/master/README.md#change-history

---

Change History

• 3.2.1
  • Fix crash when reading certain corrupted NTFS timestamp extra fields. Thanks to CodeAnt AI Code Reviewer ( https://www.codeant.ai/ai-code-review ) for finding the bug.
• 3.2.0
  • Added support for reading third-party extensions for timestamps: Info-ZIP "universal timestamp" extra field and NTFS extra field. pull #160
  • entry.getLastModDate() takes options forceDosFormat to revert the above change, and timezone to allow UTC interpretation of DOS timestamps.
  • Documented dosDateTimeToDate() as now deprecated.