CVE-2024-1485

Summary

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

Affected Software

Weaknesses

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Workarounds

Limit or block the parsing of devfiles from untrusted sources.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://access.redhat.com/security/cve/CVE-2024-1485
• https://bugzilla.redhat.com/show_bug.cgi?id=2264106
• https://github.com/advisories/GHSA-84xv-jfrm-h4gm
• https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
• https://github.com/devfile/registry-support/pull/197

References

• https://access.redhat.com/security/cve/CVE-2024-1485
• https://bugzilla.redhat.com/show_bug.cgi?id=2264106
• https://github.com/advisories/GHSA-84xv-jfrm-h4gm
• https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
• https://github.com/devfile/registry-support/pull/197

• ←Previous
• Next→