high7.5
CVE-2022-4885
sviehb/jefferson vulnerable to path traversal
Impact
A vulnerability has been found in the sviehb/jefferson JFFS2 filesystem extraction tool. This vulnerability affects unknown code of the file `src/scripts/jefferson`. The manipulation leads to path traversal. The attack can be initiated remotely. Upgrading to version 0.4 is able to address this issue as it includes https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | jefferson | < 0.4 | 0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jefferson Project | Jefferson | before 0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87
- https://github.com/sviehb/jefferson/pull/36
- https://github.com/sviehb/jefferson/releases/tag/v0.4
- https://vuldb.com/?ctiid.218020
- https://vuldb.com/?id.218020
- https://github.com/advisories/GHSA-7jrw-p8jc-v6qw
- https://nvd.nist.gov/vuln/detail/CVE-2022-4885