CVE-2021-20291

Опубликовано: 01 апр. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 7.1

EPSS Низкий

Описание

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using tar. If one of those layers is not a valid tar archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:storage_project:storage:*:*:*:*:*:*:*:*

Версия до 1.28.1 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.00111

Низкий

6.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

CWE-667

Связанные уязвимости

CVE-2021-20291

CVSS3: 6.5

ubuntu

около 4 лет назад

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

CVE-2021-20291

CVSS3: 6.5

redhat

около 4 лет назад

CVE-2021-20291

CVSS3: 6.5

debian

около 4 лет назад

A deadlock vulnerability was found in 'github.com/containers/storage' ...

GHSA-7qw8-847f-pggm

CVSS3: 6.5

github

около 4 лет назад

Improper Locking in github.com/containers/storage

RLSA-2021:4154

rocky

больше 3 лет назад

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

EPSS

Процентиль: 31%

0.00111

Низкий

6.5 Medium

CVSS3

7.1 High

CVSS2

Дефекты

CWE-667