Vulnerability-Lookup

ALSA-2021:4154

Vulnerability from osv_almalinux – Published: 2021-11-09 08:24 – Updated: 2026-10-25 23:39 – Source website

Summary

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Details

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)
containers/storage: DoS via malicious image (CVE-2021-20291)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

URL

Type

	https://access.redhat.com/errata/RHSA-2021:4154	ADVISORY
	https://bugzilla.redhat.com/1914687	REPORT
	https://bugzilla.redhat.com/1928935	REPORT
	https://bugzilla.redhat.com/1932399	REPORT
	https://bugzilla.redhat.com/1933775	REPORT
	https://bugzilla.redhat.com/1933776	REPORT
	https://bugzilla.redhat.com/1934415	REPORT
	https://bugzilla.redhat.com/1934480	REPORT
	https://bugzilla.redhat.com/1937641	REPORT
	https://bugzilla.redhat.com/1937830	REPORT
	https://bugzilla.redhat.com/1939485	REPORT
	https://bugzilla.redhat.com/1940037	REPORT
	https://bugzilla.redhat.com/1940054	REPORT
	https://bugzilla.redhat.com/1940082	REPORT
	https://bugzilla.redhat.com/1940493	REPORT
	https://bugzilla.redhat.com/1941380	REPORT
	https://bugzilla.redhat.com/1947432	REPORT
	https://bugzilla.redhat.com/1947999	REPORT
	https://bugzilla.redhat.com/1952204	REPORT
	https://bugzilla.redhat.com/1952698	REPORT
	https://bugzilla.redhat.com/1957299	REPORT
	https://bugzilla.redhat.com/1957840	REPORT
	https://bugzilla.redhat.com/1957904	REPORT
	https://bugzilla.redhat.com/1958353	REPORT
	https://bugzilla.redhat.com/1960948	REPORT
	https://bugzilla.redhat.com/1966538	REPORT
	https://bugzilla.redhat.com/1966872	REPORT
	https://bugzilla.redhat.com/1969264	REPORT
	https://bugzilla.redhat.com/1972150	REPORT
	https://bugzilla.redhat.com/1972209	REPORT
	https://bugzilla.redhat.com/1972211	REPORT
	https://bugzilla.redhat.com/1972282	REPORT
	https://bugzilla.redhat.com/1972648	REPORT
	https://bugzilla.redhat.com/1973418	REPORT
	https://bugzilla.redhat.com/1976283	REPORT
	https://bugzilla.redhat.com/1977280	REPORT
	https://bugzilla.redhat.com/1977673	REPORT
	https://bugzilla.redhat.com/1978415	REPORT
	https://bugzilla.redhat.com/1978556	REPORT
	https://bugzilla.redhat.com/1978647	REPORT
	https://bugzilla.redhat.com/1979497	REPORT
	https://bugzilla.redhat.com/1980212	REPORT
	https://bugzilla.redhat.com/1982593	REPORT
	https://bugzilla.redhat.com/1982762	REPORT
	https://bugzilla.redhat.com/1985499	REPORT
	https://bugzilla.redhat.com/1985905	REPORT
	https://bugzilla.redhat.com/1987049	REPORT
	https://bugzilla.redhat.com/1993209	REPORT
	https://bugzilla.redhat.com/1993249	REPORT
	https://bugzilla.redhat.com/1995041	REPORT
	https://bugzilla.redhat.com/1998191	REPORT
	https://bugzilla.redhat.com/1999144	REPORT
	https://bugzilla.redhat.com/2000943	REPORT
	https://bugzilla.redhat.com/2004562	REPORT
	https://bugzilla.redhat.com/2005018	REPORT
	https://errata.almalinux.org/8/ALSA-2021-4154.html	ADVISORY
	https://vulners.com/cve/CVE-2021-20291	REPORT
	https://vulners.com/cve/CVE-2021-3602	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "crit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2751+06427ca3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "crit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "crit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2751+06427ca3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2751+06427ca3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "criu-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2751+06427ca3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libslirp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libslirp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libslirp-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libslirp-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "oci-seccomp-bpf-hook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.3-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "oci-seccomp-bpf-hook"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.3-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "python3-criu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15-3.module_el8.6.0+2751+06427ca3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "slirp4netns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.8-1.module_el8.6.0+2876+9ed4eae2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "slirp4netns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.8-1.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "toolbox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "toolbox"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.99.3-0.4.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "toolbox-tests"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.99.3-0.4.module_el8.5.0+2613+1b78b731"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "toolbox-tests"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)\n\n* containers/storage: DoS via malicious image (CVE-2021-20291)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2021:4154",
  "modified": "2026-10-25T23:39:59Z",
  "published": "2021-11-09T08:24:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2021:4154"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1914687"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1928935"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1932399"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1933775"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1933776"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1934415"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1934480"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1937641"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1937830"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1939485"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1940037"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1940054"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1940082"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1940493"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1941380"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1947432"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1947999"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1952204"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1952698"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1957299"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1957840"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1957904"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1958353"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1960948"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1966538"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1966872"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1969264"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1972150"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1972209"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1972211"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1972282"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1972648"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1973418"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1976283"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1977280"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1977673"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1978415"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1978556"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1978647"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1979497"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1980212"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1982593"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1982762"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1985499"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1985905"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1987049"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1993209"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1993249"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1995041"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1998191"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/1999144"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2000943"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2004562"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2005018"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2021-4154.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-20291"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2021-3602"
    }
  ],
  "related": [
    "CVE-2021-3602",
    "CVE-2021-20291"
  ],
  "summary": "Moderate: container-tools:rhel8 security, bug fix, and enhancement update"
}

CVE-2021-20291 (GCVE-0-2021-20291)

Vulnerability from cvelistv5 – Published: 2021-04-01 17:49 – Updated: 2024-08-03 17:37

Summary

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

Severity

No CVSS data available.

CWE

CWE-667

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1042 records in the last 180 days details

References

6 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1939485	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://unit42.paloaltonetworks.com/cve-2021-20291/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	containers/storage	Affected: containers/storage 1.28.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:37:23.517Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939485"
          },
          {
            "name": "FEDORA-2021-ec00da7faa",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/"
          },
          {
            "name": "FEDORA-2021-83b3740389",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/"
          },
          {
            "name": "FEDORA-2021-a3703b9dc8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/"
          },
          {
            "name": "FEDORA-2021-c56a213327",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://unit42.paloaltonetworks.com/cve-2021-20291/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "containers/storage",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "containers/storage 1.28.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A deadlock vulnerability was found in \u0027github.com/containers/storage\u0027 in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-24T13:21:30.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939485"
        },
        {
          "name": "FEDORA-2021-ec00da7faa",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/"
        },
        {
          "name": "FEDORA-2021-83b3740389",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/"
        },
        {
          "name": "FEDORA-2021-a3703b9dc8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/"
        },
        {
          "name": "FEDORA-2021-c56a213327",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://unit42.paloaltonetworks.com/cve-2021-20291/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-20291",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "containers/storage",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "containers/storage 1.28.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A deadlock vulnerability was found in \u0027github.com/containers/storage\u0027 in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-667"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1939485",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939485"
            },
            {
              "name": "FEDORA-2021-ec00da7faa",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/"
            },
            {
              "name": "FEDORA-2021-83b3740389",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/"
            },
            {
              "name": "FEDORA-2021-a3703b9dc8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/"
            },
            {
              "name": "FEDORA-2021-c56a213327",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/"
            },
            {
              "name": "https://unit42.paloaltonetworks.com/cve-2021-20291/",
              "refsource": "MISC",
              "url": "https://unit42.paloaltonetworks.com/cve-2021-20291/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-20291",
    "datePublished": "2021-04-01T17:49:40.000Z",
    "dateReserved": "2020-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:37:23.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-3602 (GCVE-0-2021-3602)

Vulnerability from cvelistv5 – Published: 2022-03-03 18:26 – Updated: 2024-08-03 17:01

Summary

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials).

Severity

No CVSS data available.

CWE

CWE-200 - - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

redhat CNA under the redhat root

CNA scorecard B 82/100 over 1042 records in the last 180 days details

References

4 references

URL	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=1969264	x_refsource_MISC
https://ubuntu.com/security/CVE-2021-3602	x_refsource_MISC
https://github.com/containers/buildah/security/ad…	x_refsource_MISC
https://github.com/containers/buildah/commit/a468…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
n/a	buildah	Affected: Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:01:08.065Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1969264"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ubuntu.com/security/CVE-2021-3602"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "buildah",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-03T18:26:21.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1969264"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ubuntu.com/security/CVE-2021-3602"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2021-3602",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "buildah",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Affects v1.21.2, v1.20.0, v1.19.8, v1.18.0, v1.17.1, v1.16.7, Fixed in v1.21.3, v1.19.9, v1.17.2, v1.16.8, v1.22.0 and above."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RUN commands) can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment, environment variables may include sensitive information that was shared with the container in order to be used only by Buildah itself (e.g. container registry credentials)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1969264",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1969264"
            },
            {
              "name": "https://ubuntu.com/security/CVE-2021-3602",
              "refsource": "MISC",
              "url": "https://ubuntu.com/security/CVE-2021-3602"
            },
            {
              "name": "https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj",
              "refsource": "MISC",
              "url": "https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj"
            },
            {
              "name": "https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0",
              "refsource": "MISC",
              "url": "https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2021-3602",
    "datePublished": "2022-03-03T18:26:21.000Z",
    "dateReserved": "2021-06-15T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:01:08.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ALSA-2021:4154

CVE-2021-20291 (GCVE-0-2021-20291)

CVE-2021-3602 (GCVE-0-2021-3602)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour