Описание
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
Ссылки
- Third Party Advisory
- Issue TrackingThird Party Advisory
- Third Party Advisory
- Patch
- Patch
- Third Party Advisory
- Issue TrackingThird Party Advisory
- Third Party Advisory
- Patch
- Patch
Уязвимые конфигурации
Одно из
EPSS
8 High
CVSS3
9.3 Critical
CVSS3
Дефекты
Связанные уязвимости
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
registry-support: decompress can delete files outside scope via relative paths
EPSS
8 High
CVSS3
9.3 Critical
CVSS3