PT-2023-16389

CVE-2023-0592

Published

2023-01-31

Updated

2023-02-08

Description by

CVSS 3.1

5.5

Medium

MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jefferson versions prior to 0.4.1

Description A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the JFFS2 filesystem extractor until a patch is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Quentin Kaiser

Stefan Viehböck

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers