sviehb/jefferson vulnerable to path traversal

보통 5.9CVE-2022-4885 · GHSA-7jrw-p8jc-v6qw · PYSEC-2026-826 · Published 11/01/2023 · updated 17/06/2026

요약

CVE-2022-4885은(는) jefferson, jefferson (jefferson project)에 영향을 주는 보통 (CVSS 5.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.77%, 전체 취약점의 55.7%보다 높음.
조치: 0.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
jefferson PyPI	`< 0.4`	`0.4`
jefferson jefferson_project	`< 0.4`	`0.4`

Description

A vulnerability has been found in the sviehb/jefferson JFFS2 filesystem extraction tool. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. Upgrading to version 0.4 is able to address this issue as it includes https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87.

NVD description

A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218020.

References

nvd.nist.gov/vuln/detail/CVE-2022-4885 · ADVISORY
sviehb/jefferson#36 · WEB
sviehb/jefferson commit 53b3f2f · WEB
sviehb/jefferson · PACKAGE
sviehb/jefferson release v0.4 · WEB
vuldb.com · WEB
vuldb.com · WEB
pypi.org/project/jefferson · PACKAGE
GitHub Advisory GHSA-7jrw-p8jc-v6qw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

jefferson

PyPI

< 0.4

0.4

jefferson

jefferson_project

< 0.4

0.4

Description

NVD description