This vulnerability affects https://github.com/devfile/registry-support and more specifically as part
of a decompress function where we were reading archived files from a .tar
and writing them to a new location. It was reported to us that the cleaning
function we were using to ensure the file paths could not escape the
directory they were supposed to go to was not working properly. This
allowed somebody to potentially intercept the .tar file as it was being
downloaded by the client and replace it with one that contained relative
file paths. These paths when read by the decompress function would escape
the destination directory and potentially overwrite arbitrary files.

The commit that contains the fix is here:
https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d