[note - TC 11.50b7] Concerning 7z integration - Did you read the current security notice for 7z?

[peteraw]

link to heise.de:

https://www.heise.de/news/7-Zip-Luecke-ermoeglicht-Codeschmuggel-mit-manipulierten-Archiven-10083297.html
title: 7-Zip-Lücke ermöglicht Codeschmuggel mit manipulierten Archiven

just as a note

[Horst.Epp]

The linked article mentions version 24.07
Since August, the actual version is 24.08.
As of TC 11.50b7 the 7zip files are already on this version.

[ghisler(Author)]

As I understand it, the security hole is in the ZSTD compression, which isn't used for 7-Zip archives, just for ZIP archives. For unpacking ZSTD-compressed ZIP archives, I'm not using the 7-Zip library, I use the ZSTD code from here (lastest version 1.5.6 since 11.50 beta 1):
https://github.com/facebook/zstd
They did not issue any update since March, so apparently their implementation isn't affected.

Moderator message from: ghisler(Author) » 2024-11-26, 11:35 UTC

Moved to will not be changed