A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2024-1485 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2264106 | Issue Tracking Third Party Advisory |
| https://github.com/advisories/GHSA-84xv-jfrm-h4gm | Third Party Advisory |
| https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d | Patch |
| https://github.com/devfile/registry-support/pull/197 | Patch |
Configurations
Configuration 1 (hide)
|
History
21 Oct 2024, 20:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/security/cve/CVE-2024-1485 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2264106 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/advisories/GHSA-84xv-jfrm-h4gm - Third Party Advisory | |
| References | () https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d - Patch | |
| References | () https://github.com/devfile/registry-support/pull/197 - Patch | |
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.3 |
| CPE | cpe:2.3:a:devfile:registry-support:*:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:* |
|
| First Time |
Devfile registry-support
Redhat Redhat openshift Developer Tools And Services Redhat openshift Devfile |
22 Feb 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Feb 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed. |
15 Feb 2024, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope. |
14 Feb 2024, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-14 00:15
Updated : 2024-10-21 20:13
NVD link : CVE-2024-1485
Mitre link : CVE-2024-1485
CVE.ORG link : CVE-2024-1485
JSON object : View
Products Affected
devfile
- registry-support
redhat
- openshift_developer_tools_and_services
- openshift