PT-2023-16389

CVE-2023-0592

Publicado

2023-01-31

Atualizado

2023-02-08

Descrição por

CVSS 3.1

5.5

Média

MétricasAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jefferson versions prior to 0.4.1

Description A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the JFFS2 filesystem extractor until a patch is applied.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Quentin Kaiser

Stefan Viehböck

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Identificadores relacionados