Vulnerability Details CVE-2024-1485
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.9%
CVSS Severity
CVSS v3 Score 8.0
References
- https://access.redhat.com/security/cve/CVE-2024-1485
- https://bugzilla.redhat.com/show_bug.cgi?id=2264106
- https://github.com/advisories/GHSA-84xv-jfrm-h4gm
- https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
- https://github.com/devfile/registry-support/pull/197
- https://access.redhat.com/security/cve/CVE-2024-1485
- https://bugzilla.redhat.com/show_bug.cgi?id=2264106
- https://github.com/advisories/GHSA-84xv-jfrm-h4gm
- https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
- https://github.com/devfile/registry-support/pull/197
Products affected by CVE-2024-1485
-
cpe:2.3:a:devfile:registry-support:-
-
cpe:2.3:a:redhat:openshift:4.0
-
cpe:2.3:a:redhat:openshift_developer_tools_and_services:-