CVE-2024-1485
Registry-support: decompress can delete files outside scope via relative paths
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Registry-support: decompress can delete files outside scope via relative paths
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Record
CVE-2024-1485- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-0570
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Record
EUVD-2024-0570- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-84xv-jfrm-h4gm
registry-support: decompress can delete files outside scope via relative paths
A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.
- Record
GHSA-84xv-jfrm-h4gm- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22, CWE-23, CWE-73
- Updated
- 2026-11-02
NVD
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Record
CVE-2024-1485- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Registry-support: decompress can delete files outside scope via relative paths
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
- Record
CVE-2024-1485- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-84xv-jfrm-h4gm
registry-support: decompress can delete files outside scope via relative paths
A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.
- Record
GHSA-84xv-jfrm-h4gm- CVSS 4.0
- 4.6 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H - CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H - Weakness
- CWE-22, CWE-23, CWE-73
- Updated
- 2026-11-02
OSVGO-2024-2576 No score
registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library
registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/devfile/registry-support/registry-library before v0.0.0-20240206.
- Record
GO-2024-2576- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/devfile/registry-support/registry-libraryGo |
before 0.0.0-20240206 | 0.0.0-20240206 |
github.com/devfile/registry-support/registry-libraryGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1485 is a high vulnerability (CVSS 8.0) in Devfile Registry-support, published February 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in github.com/devfile/registry-support/registry-library 0.0.0-20240206.
References
access.redhat.com/security/cve/CVE-2024-1485
bugzilla.redhat.com/show_bug.cgi?id=2264106
github.com/advisories/GHSA-84xv-jfrm-h4gm
nvd.nist.gov/vuln/detail/CVE-2024-1485