CVE catalog
CVE-2021-20291
golang-github-containers-storage: CVE-2021-20291
- Severity
- Medium · CVSS 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.59% · Oct 25, 2026
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | golang-github-containers-storage | sid | 1.64.0-1 | fixed |
| Debian | golang-github-containers-storage | forky | 1.64.0-1 | fixed |
| Debian | golang-github-containers-storage | trixie | 1.57.2+ds1-1 | fixed |
| Debian | golang-github-containers-storage | bookworm | 1.43.0+ds1-8 | fixed |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.13.2+dfsg1-2 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.13.2+dfsg1-3 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.13.5+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.1+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.2+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.3+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.5+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.7+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.8+dfsg1-1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.8+dfsg1-1ubuntu1 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.8+dfsg1-1ubuntu2 | vulnerable |
| Ubuntu | golang-github-containers-storage | 20.04 | 1.15.8+dfsg1-1ubuntu2.1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | golang-github-containers-storage | source | sid | 1.34.1+ds1-1 | not yet assigned | Not reported | [988942] |
| Debian | golang-github-containers-storage | source | forky | 1.34.1+ds1-1 | not yet assigned | Not reported | [988942] |
| Debian | golang-github-containers-storage | source | trixie | 1.34.1+ds1-1 | not yet assigned | Not reported | [988942] |
| Debian | golang-github-containers-storage | source | bookworm | 1.34.1+ds1-1 | not yet assigned | Not reported | [988942] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [containers-storage]Fixed
Source package: [golang-github-containers-storage]
Details (4)
1.43.0+ds1-8+b2· amd64 · bookwormFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.43.0+ds1-8+b2· arm64 · bookwormFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.48.1+ds1-2~bpo12+1· amd64 · bookworm-backportsFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.48.1+ds1-2~bpo12+1· arm64 · bookworm-backportsFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
Source package: [golang-github-containers-storage]
Details (4)
1.43.0+ds1-8· all · bookwormFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.43.0+ds1-8· all · bookwormFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.48.1+ds1-2~bpo12+1· all · bookworm-backportsFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
1.48.1+ds1-2~bpo12+1· all · bookworm-backportsFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · bookworm; dsa · golang-github-containers-storage · debian · 12
[Debian 13 (Trixie)]
- [containers-storage]Fixed
Source package: [golang-github-containers-storage]
Details (2)
1.57.2+ds1-1+b2· amd64 · trixieFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · 13
1.57.2+ds1-1+b2· arm64 · trixieFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · 13
Source package: [golang-github-containers-storage]
Details (2)
1.57.2+ds1-1· all · trixieFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · 13
1.57.2+ds1-1· all · trixieFixed · Fixed:
1.34.1+ds1-1dsa · golang-github-containers-storage · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhba-2022_0348.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-20291]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-20291]
- [https://security-tracker.debian.org/tracker/CVE-2021-20291]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-20291.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]