CVE-2024-1485

criticalPriorität · verfolgen · 37EPSS 0.009 · 61. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.94% (61st) EPSS

CVSS 9.3 · critical

Is it mine?

5 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-23

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 8–9.3

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.8

v3.18highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:Hsecondary · ENISA EU

v3.18highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:Hsecondary · secalert@redhat.com USAusnutzbarkeit 1.6 · Auswirkung 5.8

v3.18highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:Hsecondary · OSV

v3.18.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USCWE-22USCWE-23USCWE-73US

betroffene Produkte (5)

Betroffene Produkte und Versionsbereiche.

devfile registry-support< 0.0.0-20240206nvdUScpe:2.3:a:devfile:registry-support:*:*:*:*:*:*:*:*
redhat openshift= 4.0nvdUScpe:2.3:a:redhat:openshift:*:*:*:*:*:*:*:*
redhat openshift developer tools and servicesalle VersionennvdUScpe:2.3:a:redhat:openshift_developer_tools_and_services:*:*:*:*:*:*:*:*
Go github.com/devfile/registry-support/registry-libraryalle VersionenosvUSpkg:golang/github.com/devfile/registry-support/registry-library
Go github.com/devfile/registry-support/registry-library< 0.0.0-20240206osvUSpkg:golang/github.com/devfile/registry-support/registry-library

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-84xv-jfrm-h4gmregistry-support: decompress can delete files outside scope via relative paths2024-02-14ghsa · osvUS
A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.
GO-2024-2576registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library2024-06-05vendor · osvUS
registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/devfile/registry-support/registry-library before v0.0.0-20240206.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2024-02-14geändert 2026-06-17

Referenzen (14)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan