Description
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
registry-support
Default version status: unaffected
1.16.2affected
Red Hat OpenShift Developer Tools and Services
Default version status: affected
Red Hat Red Hat OpenShift Container Platform 4
Default version status: affected
References
- https://access.redhat.com/security/cve/CVE-2024-1485 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2264106 ↗
- https://github.com/advisories/GHSA-84xv-jfrm-h4gm ↗
- https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d ↗
- https://github.com/devfile/registry-support/pull/197 ↗