Bug 2264106 (CVE-2024-1485)

Summary:	CVE-2024-1485 registry-support: decompress can delete files outside scope via relative paths
Product:	[Other] Security Response	Reporter:	Nick Tait <ntait>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	askrabec, dfreiber, drow, hvyas, jburrell, tkral, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---	Flags:	askrabec: needinfo+
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2264108

Description Nick Tait 2024-02-13 21:58:36 UTC

This vulnerability affects https://github.com/devfile/registry-support and more specifically as part
of a decompress function where we were reading archived files from a .tar
and writing them to a new location. It was reported to us that the cleaning
function we were using to ensure the file paths could not escape the
directory they were supposed to go to was not working properly. This
allowed somebody to potentially intercept the .tar file as it was being
downloaded by the client and replace it with one that contained relative
file paths. These paths when read by the decompress function would escape
the destination directory and potentially overwrite arbitrary files.

The commit that contains the fix is here:
https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d