CVE-2024-1485
Registry-support: decompress can delete files outside scope via relative paths
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Registry-support: decompress can delete files outside scope via relative paths
| Assigner | redhat |
| Reserved | 2024-02-13 |
| Published | 2024-02-13 |
| Updated | 2024-10-22 |
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
| CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H |
| 2024-02-13: | Reported to Red Hat. |
| 2024-02-05: | Made public. |
Red Hat would like to thank Joern Schneeweisz (GitLab Security Research Team) for reporting this issue.
https://access.redhat.com/security/cve/CVE-2024-1485
https://bugzilla.redhat.com/show_bug.cgi?id=2264106 (RHBZ#2264106)
https://github.com/advisories/GHSA-84xv-jfrm-h4gm
https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
https://github.com/devfile/registry-support/pull/197
