GO-2021-0100
Denial of service via deadlock in github.com/containers/storage
At a glance
- Published
- Updated
- CVE
- CVE-2021-20291
- Aliases
- GHSA-7qw8-847f-pggm
Description
Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an archive they control.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/containers/storage | introduced 0, fixed 1.28.1 |
References
- https://github.com/containers/storage/pull/860 FIX
- https://github.com/containers/storage/commit/306fcabc964470e4b3b87a43a8f6b7d698209ee1 FIX
- https://bugzilla.redhat.com/show_bug.cgi?id=1939485 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |