CVE-2024-1485
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Score
- CVSS 3.1 9.3 Critical
- Status
- Modified - secalert@redhat.com
- Published
- 2024-02-14
- Last modified
- 2026-08-06
- Weaknesses
- CWE-22
Affected products
- Registry-support (Devfile)
- Ocp Tools (Redhat)
- Openshift (Redhat)
- Openshift Developer Tools And Services (Redhat)
References
- https://access.redhat.com/security/cve/CVE-2024-1485
- https://bugzilla.redhat.com/show_bug.cgi?id=2264106
- https://github.com/advisories/GHSA-84xv-jfrm-h4gm
- https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
- https://github.com/devfile/registry-support/pull/197
