A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade toolboxUpgrade toolbox-testsUpgrade libslirpUpgrade criu-libsUpgrade podmanUpgrade skopeoUpgrade slirp4netnsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade podman-testsUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade criuUpgrade critUpgrade podman-pluginsUpgrade podman-dockerUpgrade libslirp-develUpgrade python3-criuUpgrade podman-remoteUpgrade skopeo-testsUpgrade criu-devel | May 4, 2022 | Apr 1, 2021 |
| Centos_linux | — | Upgrade conmon-debugsourceUpgrade toolbox-debugsourceUpgrade podman-catatonit-debuginfoUpgrade buildahUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade conmonUpgrade criu-debuginfoUpgrade crunUpgrade python3-podmanUpgrade podman-remote-debuginfoUpgrade toolboxUpgrade skopeoUpgrade crun-debugsourceUpgrade criuUpgrade podman-pluginsUpgrade buildah-tests-debuginfoUpgrade criu-libs-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade buildah-debuginfoUpgrade toolbox-testsUpgrade container-selinuxUpgrade criu-develUpgrade criu-libsUpgrade slirp4netns-debuginfoUpgrade podman-testsUpgrade podman-plugins-debuginfoUpgrade libslirp-develUpgrade cockpit-podmanUpgrade udicaUpgrade toolbox-debuginfoUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade libslirp-debugsourceUpgrade skopeo-debuginfoUpgrade critUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade podman-remoteUpgrade podman-debugsourceUpgrade buildah-testsUpgrade podman-dockerUpgrade containers-commonUpgrade slirp4netns-debugsourceUpgrade podman-gvproxyUpgrade libslirpUpgrade criu-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debuginfoUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade python3-criuUpgrade runcUpgrade podman-debuginfo | Nov 10, 2021 | Apr 1, 2021 |
| Debian | — | Upgrade golang-github-containers-storage | Jul 30, 2024 | Apr 1, 2021 |
| Dell Powerstore Dsa2023366 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 5, 2023 |
| Oracle_linux | — | Upgrade crunUpgrade runcUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-testsUpgrade criu-develUpgrade podman-pluginsUpgrade conmonUpgrade udicaUpgrade criu-libsUpgrade libslirp-develUpgrade container-selinuxUpgrade podman-remoteUpgrade python3-criuUpgrade critUpgrade containers-commonUpgrade podman-catatonitUpgrade fuse-overlayfsUpgrade podmanUpgrade slirp4netnsUpgrade skopeoUpgrade podman-gvproxyUpgrade buildah-testsUpgrade python3-podmanUpgrade libslirpUpgrade containernetworking-pluginsUpgrade cockpit-podmanUpgrade buildahUpgrade criuUpgrade podman-docker | Nov 22, 2022 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade podmanUpgrade openshift-ansibleUpgrade ironic-images-ipa-ppc64leUpgrade python-oslo-dbUpgrade kata-containersUpgrade python-hardwareUpgrade haproxyUpgrade jenkinsUpgrade jenkins-2-pluginsUpgrade python-ironic-prometheus-exporterUpgrade openshift-clientsUpgrade ironic-images-ipa-x86_64Upgrade python-oslo-configUpgrade python-toozUpgrade python-pyrsistentUpgrade toolboxUpgrade python-oslo-i18nUpgrade python-oslo-policyUpgrade python-keystoneauth1Upgrade ignitionUpgrade atomic-openshift-service-idlerUpgrade python-oslo-utilsUpgrade python-eventletUpgrade openshiftUpgrade python-oslo-concurrencyUpgrade openshift-kuryrUpgrade ovn2.13Upgrade butaneUpgrade ironic-imagesUpgrade console-login-helper-messagesUpgrade python-sushy-oem-idracUpgrade cri-oUpgrade python-kubernetesUpgrade python-debtcollectorUpgrade python-openstacksdkUpgrade python-oslo-serviceUpgrade rust-afterburnUpgrade runcUpgrade python-stevedoreUpgrade cri-toolsUpgrade python-oslo-serializationUpgrade python-oslo-upgradecheckUpgrade python-sushyUpgrade rteval-loadsUpgrade python-openshiftUpgrade ostreeUpgrade openvswitch2.15Upgrade python-ironic-libUpgrade openstack-ironic-inspectorUpgrade python-jsonschemaUpgrade redhat-release-coreosUpgrade openstack-ironicUpgrade python-oslo-logUpgrade coreos-installerUpgrade python-oslo-contextUpgrade openstack-ironic-python-agent | Apr 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | Upgrade buildah-tests-debuginfoUpgrade buildah-testsUpgrade runc-debuginfoUpgrade criu-develUpgrade slirp4netnsUpgrade crun-debuginfoUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade toolboxUpgrade skopeo-testsUpgrade buildah-debuginfoUpgrade conmon-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade podman-gvproxyUpgrade podman-dockerUpgrade criu-debuginfoUpgrade libslirp-develUpgrade conmonUpgrade skopeo-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containers-commonUpgrade podman-testsUpgrade python3-podmanUpgrade criu-libsUpgrade cockpit-podmanUpgrade conmon-debuginfoUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildahUpgrade criu-debugsourceUpgrade podman-remote-debuginfoUpgrade skopeoUpgrade podman-gvproxy-debuginfoUpgrade toolbox-debuginfoUpgrade podman-catatonit-debuginfoUpgrade criu-libs-debuginfoUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade critUpgrade criuUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-testsUpgrade podmanUpgrade podman-remoteUpgrade fuse-overlayfsUpgrade runc-debugsourceUpgrade podman-debuginfoUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade libslirp-debugsourceUpgrade runcUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade udicaUpgrade python3-criuUpgrade podman-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade crunNo solution existsUpgrade skopeo-debugsource | Nov 10, 2021 | Apr 1, 2021 |
| Rocky_linux | — | Upgrade criu-develUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade crunUpgrade libslirp-debugsourceUpgrade toolbox-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade skopeoUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade toolbox-testsUpgrade criuUpgrade podman-plugins-debuginfoUpgrade podmanUpgrade containernetworking-pluginsUpgrade critUpgrade runcUpgrade containernetworking-plugins-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade skopeo-debugsourceUpgrade python3-criuUpgrade libslirp-debuginfoUpgrade toolbox-debugsourceUpgrade podman-pluginsUpgrade slirp4netns-debugsourceUpgrade criu-debugsourceUpgrade criu-libs-debuginfoUpgrade podman-catatonitUpgrade podman-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade podman-gvproxyUpgrade fuse-overlayfsUpgrade skopeo-debuginfoUpgrade podman-remote-debuginfoUpgrade buildah-debuginfoUpgrade conmonUpgrade buildah-testsUpgrade buildah-debugsourceUpgrade podman-testsUpgrade libslirp-develUpgrade criu-debuginfoUpgrade conmon-debuginfoUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade runc-debuginfoUpgrade toolboxUpgrade conmon-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade crun-debuginfoUpgrade criu-libsUpgrade slirp4netnsUpgrade libslirp | Mar 12, 2024 | Apr 1, 2021 |
| Suse | — | Upgrade libcontainers-commonUpgrade libseccomp2-32bitUpgrade libseccomp-develUpgrade podman-cni-configUpgrade podmanUpgrade libseccomp-toolsUpgrade conmonUpgrade libseccomp2 | Mar 5, 2022 | Apr 1, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub