Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2024-1485 Details

Description

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/security/cve/CVE-2024-1485 CVEThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2264106 CVEIssue TrackingThird Party Advisory
https://github.com/advisories/GHSA-84xv-jfrm-h4gm CVEThird Party Advisory
https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d CVEPatch
https://github.com/devfile/registry-support/pull/197 CVEPatch

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')[email protected]
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')[email protected]

Affected Products

ProductVersions
devfile registry-support
< 0.0.0-20240206

CPE

  • cpe:2.3:a:devfile:registry-support:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat openshift
4.0

CPE

  • cpe:2.3:a:redhat:openshift:4.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat openshift developer tools and services
All versions

CPE

  • cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

12 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2024-1485
NVD Published Date:
Feb 14, 2024
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2024-1485 Details - Not Deferred