CVSS 3.1
9.3 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:HCVE-2024-1485
Critical (9.3). EPSS 0.9% chance of exploitation in the next 30 days. Fixed in github.com/devfile/registry-support/registry-library 0.0.0-20240206.
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- devfile:registry-support
- redhat:openshift
- redhat:openshift_developer_tools_and_services
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-84xv-jfrm-h4gm | Go | github.com/devfile/registry-support/registry-library | <0.0.0-20240206 | 0.0.0-20240206 |
| GO-2024-2576 | Go | github.com/devfile/registry-support/registry-library | all versions | no fix published |