CVE-2024-1485

2024-02-1400:15:46

CWE-23

[email protected]

web.nvd.nist.gov

information security

vulnerability

registry-support

decompression

remote attacker

file overwrite

nvd

cve-2024-1485

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.3%

JSON

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "OpenShift Developer Tools and Services",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "odo",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:ocp_tools"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift Container Platform 4",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "openshift4/ose-console",
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:/a:redhat:openshift:4"
    ]
  }
]