CVE-2024-1485: registry-support: decompress can delete files outside scope via relative paths
(updated )
A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.
References
- access.redhat.com/security/cve/CVE-2024-1485
- bugzilla.redhat.com/show_bug.cgi?id=2264106
- github.com/advisories/GHSA-84xv-jfrm-h4gm
- github.com/devfile/registry-support
- github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
- github.com/devfile/registry-support/pull/197
- nvd.nist.gov/vuln/detail/CVE-2024-1485
Code Behaviors & Features
Detect and mitigate CVE-2024-1485 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →