What is GHSA-7jrw-p8jc-v6qw?

GHSA-7jrw-p8jc-v6qw is a security advisory published by GitHub Security Advisories with High severity. sviehb/jefferson vulnerable to path traversal

Which CVE IDs does GHSA-7jrw-p8jc-v6qw cover?

GHSA-7jrw-p8jc-v6qw covers the following CVE IDs: CVE-2022-4885. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7jrw-p8jc-v6qw?

GHSA-7jrw-p8jc-v6qw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-7jrw-p8jc-v6qw?

GHSA-7jrw-p8jc-v6qw affects 1 product, including: pip/jefferson:\u003c 0.4.

GHSA-7jrw-p8jc-v6qwHighCVSS 7.5

sviehb/jefferson vulnerable to path traversal

Vendor

GitHub Security Advisories

Published

January 11, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2022-4885 →

📋 Description

A vulnerability has been found in the sviehb/jefferson JFFS2 filesystem extraction tool. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. Upgrading to version 0.4 is able to address this issue as it includes https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87.

🎯 Affected products1

pip/jefferson:< 0.4

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2022-4885
https://github.com/sviehb/jefferson/pull/36
https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87
https://github.com/sviehb/jefferson/releases/tag/v0.4
https://vuldb.com/?ctiid.218020
https://vuldb.com/?id.218020
https://github.com/advisories/GHSA-7jrw-p8jc-v6qw