CVE-2024-1485
High
Description
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
SeverityHigh
CVSS8.0
Exploit probability—
Product
Devfile Registry-support
PublishedFeb 14, 2024
First seenFeb 14, 2024
Weakness typeCWE-22Path traversal
How to fix
Update
- devfile registry-support0.0.0-20240206 or later
- github.com/devfile/registry-support/registry-library0.0.0-20240206 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| devfile registry-support | v < 0.0.0-20240206 | 0.0.0-20240206 |
| redhat openshift | 4.0 | — |
| redhat openshift_developer_tools_and_services | No range specified | — |
| github.com/devfile/registry-support/registry-libraryGo | v < 0.0.0-20240206, No range specified | 0.0.0-20240206 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.