Description
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | registry-support | 1.16.2 | — |
| Red Hat | OpenShift Developer Tools and Services | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/devfile/registry-support/registry-library | < 0.0.0-20240206 | 0.0.0-20240206 | GHSA-84xv-jfrm-h4gm |
| Go | github.com/devfile/registry-support/registry-library | all versions | — | GO-2024-2576 |