CVE-2024-1485 — Registry-support: decompress can delete files outside scope via relative paths
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which …
Published: 2024-02-13 · CVSS: 8.0 · CVSS 3.1
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7