CVE-2024-1485

Katalog CVE

CVSS 9.3 · Critical EPSS 0,94%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada devfile registry-support, redhat openshift +1 lainnya. Skor CVSS 3.1 9.3 (Critical) menurut NVD.

Deskripsi (NVD)

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

Rincian

Terbit di NVD

14 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.3 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 59,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d patch
• https://github.com/devfile/registry-support/pull/197 patch
• https://access.redhat.com/security/cve/CVE-2024-1485 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2264106 issue tracking · advisory pihak ketiga
• https://github.com/advisories/GHSA-84xv-jfrm-h4gm advisory pihak ketiga