CVE-2024-1485 is a high severity (CVSS 8.0) path traversal in the decompression function of devfile registry-support, also listed for Red Hat OpenShift. A user tricked into parsing a devfile that uses the parent or plugin keywords could cause files outside the archive to be overwritten or deleted. Apply the vendor fix.
What's affected
The record lists the devfile registry-support library and Red Hat OpenShift products, including OpenShift developer tools and services. It gives no version ranges in the description.
The references include the Red Hat CVE page, a Red Hat bugzilla entry, a GitHub advisory GHSA-84xv-jfrm-h4gm, a commit and a pull request. I could not read the version details from the pages I retrieved, so I will not state a fixed version here. Use the Red Hat CVE page for supported OpenShift products, and the GitHub advisory for Go module versions of registry-support.
How to check if you're exposed
If your project depends on the library as a Go module, look for it in your module graph:
go list -m all | grep devfile/registry-support
Compare the version with the patched version in the GitHub advisory. For OpenShift and its developer tools, use the Red Hat CVE page to identify your product and the erratum that fixes it. Also review where devfiles come from in your environment, because the trigger is parsing a devfile that someone else wrote.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find where registry-support or the affected OpenShift tools run.
- Read the GitHub advisory and the Red Hat CVE page for the fixed versions.
- Update the Go module or apply the Red Hat erratum.
- Only parse devfiles from sources you trust until patched.
- Run developer tooling under accounts with limited file system access.
Why it matters
The class is CWE-22, path traversal, often called the zip slip pattern when it appears in archive extraction. A file name inside an archive pointed outside the directory the tool meant to write to, and the cleanup step acted on that path.
The effect is overwriting or deleting files the user account can touch. The attack needs a person to parse a hostile devfile, so social engineering or a poisoned registry is the realistic route. The record's KEV flag is false.
Quick check
What does the attacker need to do?
Get a user to parse a devfile that uses the parent or plugin keyword and pulls a malicious archive.
Where are the fixed versions listed?
On the Red Hat CVE page and the GitHub advisory in the record. I did not confirm them, so check both.
Sources
- Red Hat CVE page (listed in the NVD record, not retrieved)
- GitHub advisory GHSA-84xv-jfrm-h4gm (listed in the NVD record, not retrieved)
- Fix pull request (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1485
Last reviewed: 19 October 2026.
