GitHub Advisoryadvisory · PyPI

GHSA-7jrw-p8jc-v6qw sviehb/jefferson vulnerable to path traversal

HIGH Published 2023-01-11 Modified 2023-11-07 Official page ↗
Aliases
CVE-2022-4885
Ecosystem
PyPI
Packages
jefferson
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2023-11-07

Affected packages

• PyPI jefferson: < 0.4 → fixed in 0.4

Description

A vulnerability has been found in the sviehb/jefferson JFFS2 filesystem extraction tool. This vulnerability affects unknown code of the file `src/scripts/jefferson`. The manipulation leads to path traversal. The attack can be initiated remotely. Upgrading to version 0.4 is able to address this issue as it includes https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87.

Related

Alias · CVE (1)

  • CVE-2022-4885 A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References