PT-2022-25999 · Nadesiko3 · Nadesiko3

Satoki Tsuji · Published 2022-12-05 · Updated 2025-04-24 · CVE-2022-41642

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nadesiko3 (PC Version) versions 3.3.61 and earlier Nadesiko3 (PC Version) versions 3.3.68 and earlier

Description The issue allows a remote attacker to execute an arbitrary OS command when processing compression and decompression on the product. Release notes for versions 3.3.62 and 3.3.69 link to patches for this issue, and the JPCERT/CC advisory lists versions 3.3.68 and prior as vulnerable, with the most recent patch tagged with version 3.3.69.

Recommendations For versions 3.3.61 and earlier, update to version 3.3.69 or later to resolve the issue. For versions 3.3.62 through 3.3.68, update to version 3.3.69 or later to resolve the issue. As a temporary workaround, consider restricting access to compression and decompression functionality until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-41642

GHSA-M8R5-7WF4-63MW

Affected Products

Nadesiko3

References · 13

• https://github.com/kujirahand/nadesiko3/issues/1325 · Patch
• https://github.com/kujirahand/nadesiko3/issues/1347 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41642 · Security Note
• https://osv.dev/vulnerability/GHSA-m8r5-7wf4-63mw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41642 · Vendor Advisory
• https://github.com/kujirahand/nadesiko3/commit/124871c064cfc65cdcd83205637e84fc246c76df · Note
• https://github.com/kujirahand/nadesiko3 · Note
• https://github.com/kujirahand/nadesiko3/commit/61a70792752a75b7f71df214e98a236721ea3fa6 · Note
• https://github.com/kujirahand/nadesiko3/commit/56ccfb2f9cceaec83e6a9d3024c3ba8c54ebe1a4 · Note
• https://github.com/kujirahand/nadesiko3/releases/tag/3.3.62 · Note
• https://github.com/kujirahand/nadesiko3/releases/tag/3.3.69 · Note
• https://t.me/cvenotify/119676 · Telegram Post
• https://jvn.jp/en/jp/JVN56968681/index.html · Note