PT-2022-27633 · Unknown · Ubi Reader

Qkaiser · Published 2022-12-17 · Updated 2022-12-22 · CVE-2022-4572

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions UBI Reader versions up to 0.8.0

Description A vulnerability has been found in the UBIFS File Handler component, specifically affecting the ubireader extract files function of the file ubireader/ubifs/output.py. This issue leads to path traversal and can be exploited remotely.

Recommendations For UBI Reader versions up to 0.8.0, upgrade to version 0.8.5 to address this issue. As a temporary workaround, consider restricting access to the ubireader extract files function until the upgrade is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-4572

GHSA-HC37-84V3-8GMQ

PYSEC-2022-43016

Affected Products

Ubi Reader

References · 11

• https://github.com/jrspruitt/ubi_reader/commit/d5d68e6b1b9f7070c29df5f67fc060f579ae9139 · Patch
• https://github.com/jrspruitt/ubi_reader/pull/57 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-4572 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4572 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hc37-84v3-8gmq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-43016 · Vendor Advisory
• https://github.com/jrspruitt/ubi_reader/releases/tag/v0.8.5-master · Note
• https://github.com/jrspruitt/ubi_reader · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ubi-reader/PYSEC-2022-43016.yaml · Note
• https://t.me/cvenotify/40424 · Telegram Post
• https://vuldb.com/?id.216146 · Note