How to mitigate a security risk related to the use of ZLib in clrcompression.dll?

Gilad Noy 46 Reputation points
2022-08-24T13:30:08.527+00:00

Hello,

We have a UWP app that requires compressing and decompressing streams and files.
It seems that using System.IO.Compression adds an import for clrcompression.dll into the app package.
When scanning our package we found that clrcompression.dll includes a native version of zlib version 1.2.11 (ref).
This library includes 2 high severity vulnerabilities which pose a security risk:
https://nvd.nist.gov/vuln/detail/CVE-2018-25032
https://nvd.nist.gov/vuln/detail/CVE-2022-37434

Is it possible to tell what APIs in the system compression namespace are affected by these vulnerabilities?
Is there a known workaround to avoid having the vulnerable library in our package?

Thanks,
Gilad.

Universal Windows Platform (UWP)
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Roy Li - MSFT 32,051 Reputation points Microsoft Vendor
    2022-08-25T03:02:37.643+00:00

    Hello,

    Welcome to Microsoft Q&A!

    Since your issue is related to the severity vulnerabilities, I'm afraid is not suitable to discuss in the Forum. This issue needs more professional tech support from the team. For your scenario, I suggest that you might need to open a support ticket for this. Please contact our paid phone support at MS Support. You will get 1:1 support on that. Select Developer Tools -> Windows UWP Development -> Windows 10 Universal App Dev ->System Services Development in the support page and you could contact the team. Please kindly note that your support ticket will be free if it is Microsoft's issue.

    Thank you.

    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments