CVE-2024-1485

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

• CWE-22
• CWE-22

• https://access.redhat.com/security/cve/CVE-2024-1485Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2264106Issue Tracking, Third Party Advisory
• https://github.com/advisories/GHSA-84xv-jfrm-h4gmThird Party Advisory
• https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0dPatch
• https://github.com/devfile/registry-support/pull/197Patch
• https://access.redhat.com/security/cve/CVE-2024-1485Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2264106Issue Tracking, Third Party Advisory
• https://github.com/advisories/GHSA-84xv-jfrm-h4gmThird Party Advisory
• https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0dPatch
• https://github.com/devfile/registry-support/pull/197Patch

Published

Feb 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1479The WP Show Posts plugin for WordPress is vulnerable to Sens…5.3
• CVE-2024-1480Unitronics Vision Standard line of controllers allow the Inf…7.5
• CVE-2024-1481A flaw was found in FreeIPA. This issue may allow a remote a…5.3
• CVE-2024-1482An incorrect authorization vulnerability was identified in G…6.5
• CVE-2024-1483A path traversal vulnerability exists in mlflow/mlflow versi…7.5
• CVE-2024-1484The Booking for Appointments and Events Calendar – Amelia pl…6.1
• CVE-2024-1486Elevation of privileges via misconfigured access control lis…7.4
• CVE-2024-1487The Photos and Files Contest Gallery WordPress plugin before…5.4
• CVE-2024-1488A vulnerability was found in Unbound due to incorrect defaul…7.3
• CVE-2024-1489The SMS Alert Order Notifications – WooCommerce plugin for W…4.3
• CVE-2024-1490An authenticated remote attacker with high privileges can ex…7.2
• CVE-2024-1491The devices allow access to an unprotected endpoint that all…8.7