malicious-devfile-registry

悪意のあるDevfileレジストリ このプロジェクトには、GitLabのCVE-2024-0402を悪用するために使用できる悪意のあるDevfileレジストリが含まれています。 エクスプロイト nodejs:2.2.1スタックがインデックス化され、archive.tarファイルを公開します。これは、registry-supportライブラリ v1.1.0より前のパストラバーサルの脆弱性を悪用しています。 tarの場所 : malicious-devfile-registry/stacks/nodejs/2.2.1/archive.tar...

binfinder

binfinder 查找未通过软件包管理器安装的二进制文件 先决条件 软件 go 版本 = 1.12 docker 版本 = 19 如何构建和运行 binfinder 构建 root@kitploit: $ make build 构建完成后，可以通过以下命令来运行 bindfinder： root@kitploit: $ ./binfinder --images --output data --top 20 输出将是每个镜像的 diff 文件，top 标志（默认 0）如果值大于 0，则会拉取最受欢迎的 N 个镜像来运行 binfinder。 要在查找差异后对生成的 diff...

GO-2024-2576 registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library

registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GHSA-84XV-JFRM-H4GM registry-support: decompress can delete files outside scope via relative paths

A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files...

registry-support: decompress can delete files outside scope via relative paths

A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files...

CVE-2024-1485

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

Design/Logic Flaw

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

CVE-2024-1485

CVE-2024-1485 affects the registry-support library’s decompression logic. An unauthenticated attacker can trick a user into parsing a devfile that uses the parent or plugin keywords, causing the decompressor to extract archives with relative paths that write outside the intended scope. This can l...

CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

PT-2024-18086 · Unknown · Registry-Support

Name of the Vulnerable Software and Affected Versions: registry-support versions prior to v0.0.0-20240206 Description: A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which...

openSUSE: Security Advisory for singularity (openSUSE-SU-2018:3316-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...