Detections
Analytics

SCA: security update for ubi-reader (GHSA-hc37-84v3-8gmq)

medium Tenable Cloud Security Plugin ID 415631

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability, which was classified as problematic, has been found in UBI Reader up to 0.8.0. Affected
 by this issue is the function ubireader_extract_files of the file ubireader/ubifs/output.py of the
 component UBIFS File Handler. The manipulation leads to path traversal. The attack may be launched
 remotely. Upgrading to version 0.8.5 is able to address this issue. The name of the patch is
 d5d68e6b1b9f7070c29df5f67fc060f579ae9139. It is recommended to upgrade the affected component. VDB-216146
 is the identifier assigned to this vulnerability. (CVE-2022-4572)

See Also

https://github.com/advisories/GHSA-hc37-84v3-8gmq

Plugin Details

Severity: Medium

ID: 415631

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.6

Temporal Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2022-4572

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 4.5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/17/2022

Vulnerability Publication Date: 12/17/2022

Reference Information

CVE: CVE-2022-4572

cwe: CWE-22