REDHAT-BUG-2264106: High severity devfile registry-support vulnerability

Published Feb 13, 2024
·
Updated

This vulnerability affects https://github.com/devfile/registry-support and more specifically as part of a decompress function where we were reading archived files from a .tar and writing them to a new location. It was reported to us that the cleaning function we were using to ensure the file paths could not escape the directory they were supposed to go to was not working properly. This allowed somebody to potentially intercept the .tar file as it was being downloaded by the client and replace it with one that contained relative file paths. These paths when read by the decompress function would escape the destination directory and potentially overwrite arbitrary files.

The commit that contains the fix is here: https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d

Affected Software

1 affected component
devfile registry-support

Event History

Feb 13, 2024
Data Sourced
via Red Hat·09:58 PM
DescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2264106?

The severity of REDHAT-BUG-2264106 has not been specified but it involves potential security risks associated with file handling in the Devfile registry-support.

2

How do I fix REDHAT-BUG-2264106?

To fix REDHAT-BUG-2264106, ensure that you implement the latest patches or updates provided by the Devfile registry-support maintainers.

3

What does REDHAT-BUG-2264106 affect?

REDHAT-BUG-2264106 affects the decompress function in the Devfile registry-support when handling archived files from .tar.

4

When was REDHAT-BUG-2264106 reported?

REDHAT-BUG-2264106 was reported recently but the exact date is not specified in the provided information.

5

Is there a workaround for REDHAT-BUG-2264106?

There is no specific workaround mentioned for REDHAT-BUG-2264106, so updating to a fixed version is recommended.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203