CVE-2023-24785: 
NixOS vulnerability analysis and mitigation

An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature. The vulnerability was discovered and reported on January 20, 2023, and was assigned the identifier CVE-2023-24785 (MITRE, NVD).

The vulnerability occurs when the End Of Archive tag is not found in the archive file, causing the application to fail to correctly terminate and re-start parsing the archive. This can lead to CPU resource exhaustion, potentially causing system freezes (SourceForge Ticket).

When exploited, this vulnerability can cause system resource exhaustion, particularly affecting CPU usage, which may result in system freezes and denial of service conditions (SourceForge Ticket).

The vulnerability has been demonstrated with a proof of concept file, and testing on Fedora 37 with PeaZip v9.0.0 confirmed the system freeze due to CPU resource exhaustion (SourceForge Ticket).

The issue was fixed in PeaZip 9.1.0 with the update of Pea to version 1.12. The update properly handles malformed PEA archives, including cases of incorrect compression buffer size, missing end of archive tag, and other cases of invalid/incomplete header and incorrect termination of the archive (SourceForge Ticket).