{"id":"CVE-2024-1485","aliases":["EUVD-2024-0570","GHSA-84xv-jfrm-h4gm","GO-2024-2576"],"status":"published","title":"Registry-support: decompress can delete files outside scope via relative paths","description":"A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00942,"percentile":0.6132,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-23","CWE-73"],"published":"2024-02-13T23:31:14Z","modified":"2026-10-28T02:30:21Z","fixes":[{"ecosystem":"Go","package":"github.com/devfile/registry-support/registry-library","fixed_in":["0.0.0-20240206"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/devfile/registry-support/registry-library","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20240206"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/devfile/registry-support/registry-library","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20240206"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/devfile/registry-support/registry-library","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"devfile","product":"registry-support"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"redhat","product":"openshift"},{"vendor":"redhat","product":"openshift_developer_tools_and_services"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-1485","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264106","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/advisories/GHSA-84xv-jfrm-h4gm","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/devfile/registry-support/pull/197","tags":["x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1485","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1485.json","tags":["advisory"]},{"url":"https://github.com/devfile/registry-support","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-1485","title":"Registry-support: decompress can delete files outside scope via relative paths","description":"A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.","status":"published","published":"2024-02-13T23:31:14.427Z","modified":"2026-08-06T18:35:34.036Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:18.259965Z"}],"euvd":[{"id":"EUVD-2024-0570","description":"A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.","status":"published","published":"2024-02-13T23:31:14Z","modified":"2026-08-06T18:35:34Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-84xv-jfrm-h4gm","title":"registry-support: decompress can delete files outside scope via relative paths","description":"A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.","status":"published","published":"2024-02-14T00:35:42Z","modified":"2026-02-27T20:59:08Z","cvss":[{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"medium"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22","CWE-23","CWE-73"],"updated_at":"2026-11-02T14:39:28.962954Z"}],"nvd":[{"id":"CVE-2024-1485","description":"A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.","status":"published","published":"2024-02-14T00:15:46.783Z","modified":"2026-06-17T07:04:20.707Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:35.738752Z"}],"osv":[{"id":"CVE-2024-1485","title":"Registry-support: decompress can delete files outside scope via relative paths","description":"A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.","status":"published","published":"2024-02-13T23:31:14.427Z","modified":"2026-10-28T02:30:21.405960159Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"GHSA-84xv-jfrm-h4gm","title":"registry-support: decompress can delete files outside scope via relative paths","description":"A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.","status":"published","published":"2024-02-14T00:35:42Z","modified":"2026-09-10T03:50:05.457573639Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","level":"high"},{"version":"4.0","score":4.6,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"medium"}],"cwes":["CWE-22","CWE-23","CWE-73"],"updated_at":"2026-11-02T15:46:41.732368Z"},{"id":"GO-2024-2576","title":"registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library","description":"registry-support: decompress can delete files outside scope via relative paths in github.com/devfile/registry-support/registry-library.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/devfile/registry-support/registry-library before v0.0.0-20240206.","status":"published","published":"2024-06-05T15:10:52Z","modified":"2026-06-19T18:29:29.149307014Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}