CVE-2024-1485

moderate-risk
Published 2024-02-14

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

Do I need to act?

~
2.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.0/10 High
NETWORK / HIGH complexity

Affected Products (3)

Registry-Support

Affected Vendors

Redhat Devfile

References (10)

Third Party Advisory https://access.redhat.com/security/cve/CVE-2024-1485
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2264106
Third Party Advisory https://github.com/advisories/GHSA-84xv-jfrm-h4gm
Patch https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d...
Patch https://github.com/devfile/registry-support/pull/197
Third Party Advisory https://access.redhat.com/security/cve/CVE-2024-1485
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2264106
Third Party Advisory https://github.com/advisories/GHSA-84xv-jfrm-h4gm
Patch https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d...
Patch https://github.com/devfile/registry-support/pull/197
38
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 5/34 · Minimal
Exposure 9/34 · Low