Registry-support: decompress can delete files outside scope via relative paths
Priority MEDIUM 42CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00942 61st percentileScored 2026-11-07
Fix Partial github.com/devfile/registry-support/registry-library (Go): 0.0.0-20240206Red Hat: 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | registry-support | 1.16.2 | — | No fix listed | CNA |
| Red Hat | OpenShift Developer Tools and Services | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| — | github.com/devfile/registry-support/registry-library (Go) | before 0.0.0-20240206 | 0.0.0-20240206 | Patch available | GHSA-84xv-jfrm-h4gm |
- registry-support Vendor— Affected 1.16.2 Fixed in — No fix listed CNA
- OpenShift Developer Tools and Services VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- github.com/devfile/registry-support/registry-library (Go) Vendor— Affected before 0.0.0-20240206 Fixed in 0.0.0-20240206 Patch available GHSA-84xv-jfrm-h4gm
CPE configurations NVD · 3
Remediation
- Fix · GHSA-84xv-jfrm-h4gm github.com/devfile/registry-support/registry-library (Go) Fixed in 0.0.0-20240206 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1485
- 2026-10-03 Alias added: GHSA-84xv-jfrm-h4gm
References
Patch 2
Advisory 4
More Red Hat Openshift vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2015-04472 The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote… KEVCVSS 3.1HIGH 7.5
- TI-2015-06239 Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data… CVSS 3.0CRITICAL 9.8
- TI-2019-04061 runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows… CVSS 3.1HIGH 8.6
- TI-2016-00709 Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow… CVSS 3.0HIGH 8.8
- TI-2024-11209 Rsync: info leak via uninitialized stack contents CVSS 3.1HIGH 7.5
Sources
- CVE-2024-1485 · CVE Program
- CVE-2024-1485 · NVD
- FIRST EPSS
- GHSA-84xv-jfrm-h4gm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-1485 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences