PT-2023-16389 · Jefferson · Jefferson

Quentin Kaiser + 1 · Publicado 2023-01-31 · Atualizado 2023-02-08 · CVE-2023-0592

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions jefferson versions prior to 0.4.1

Description A path traversal issue affects jefferson's JFFS2 filesystem extractor. Attackers can craft malicious JFFS2 files to force jefferson to write outside of the extraction directory.

Recommendations For versions prior to 0.4.1, update to version 0.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the JFFS2 filesystem extractor until a patch is applied.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-0592

Produtos afetados

Jefferson

Referências · 6

• 🔥 https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk · Exploit
• https://github.com/sviehb/jefferson/commit/971aca1a8b3b9f4fcb4674fa9621d3349195cdc6 · Correção
• https://t.me/cibsecurity/57215 · Publicação no Telegram
• https://t.me/cybersecuritytechnologies/7674 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-0592 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0592 · Aviso do Fabricante