Bug 785895 – [Tracker] Deadlock vulnerability through embedded app-emulation/containers-storage (CVE-2021-20291)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2021-04-26 21:20:49 UTC]

CVE-2021-20291 (https://nvd.nist.gov/vuln/detail/CVE-2021-20291):
  A deadlock vulnerability was found in 'github.com/containers/storage' in
  versions before 1.28.1. When a container image is processed, each layer is
  unpacked using `tar`. If one of those layers is not a valid `tar` archive
  this causes an error leading to an unexpected situation where the code
  indefinitely waits for the tar unpacked stream, which never finishes. An
  attacker could use this vulnerability to craft a malicious image, which when
  downloaded and stored by an application using containers/storage, would then
  cause a deadlock leading to a Denial of Service (DoS).

[addCollapseLink(1, 1, 'Toggle comment display'); Comment 1 NATTkA bot 2021-07-29 17:22:44 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(2, 1, 'Toggle comment display'); Comment 2 NATTkA bot 2021-07-29 17:31:01 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(3, 1, 'Toggle comment display'); Comment 3 NATTkA bot 2021-07-29 17:38:58 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(4, 1, 'Toggle comment display'); Comment 4 NATTkA bot 2021-07-29 17:47:08 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[addCollapseLink(5, 1, 'Toggle comment display'); Comment 5 NATTkA bot 2021-07-29 18:03:05 UTC Comment hidden (obsolete)]

Package list is empty or all packages have requested keywords.

[Comment 6 NATTkA bot 2021-07-29 18:11:23 UTC]

Package list is empty or all packages have requested keywords.

[Comment 7 John Helmert III 2022-07-15 04:25:47 UTC]

All dependencies are done!