Read the docs
TI-2021-03581 Aliases CVE-2021-20291GHSA-7qw8-847f-pggm

Uncontrolled resource consumption in containers/storage

Priority LOW 32CWE-667Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-667 and the CVSS impact.

Summary

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

Why it matters now

EPSS 0.01587 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/containers/storage (Go): 1.28.1Red Hat: 7 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—containers/storagecontainers/storage 1.28.1—No fix listedCNA
—github.com/containers/storage (Go)before 1.28.11.28.1Patch availableGHSA-7qw8-847f-pggm
  • containers/storage Vendor— Affected containers/storage 1.28.1 Fixed in — No fix listed CNA
  • github.com/containers/storage (Go) Vendor— Affected before 1.28.1 Fixed in 1.28.1 Patch available GHSA-7qw8-847f-pggm

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:storage_project:storage:*:*:*:*:*:*:*:*before 1.28.1VulnerableStorage Project
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*4.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*34VulnerableFedoraproject
  • cpe:2.3:a:storage_project:storage:*:*:*:*:*:*:*:* Versions before 1.28.1 Vulnerable ·Storage Project
  • cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-7qw8-847f-pggm github.com/containers/storage (Go) Fixed in 1.28.1 Advisory →

Red Hat 7 advisories

  • RHSA-2022:8008 Released 2022-11-15 · Red Hat rating Moderate
    buildah security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.27.0-2.el9, buildah-tests-1:1.27.0-2.el9
  • RHSA-2022:7954 Released 2022-11-15 · Red Hat rating Moderate
    podman security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-3.el9, podman-docker-2:4.2.0-3.el9, podman-gvproxy-2:4.2.0-3.el9 +3
  • RHSA-2022:7955 Released 2022-11-15 · Red Hat rating Moderate
    skopeo security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 9) skopeo-2:1.9.2-1.el9, skopeo-tests-2:1.9.2-1.el9
Show 4 more Red Hat advisories
  • RHSA-2021:4154 Released 2021-11-09 · Red Hat rating Moderate
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.22.3-2.module+el8.5.0+12582+56d94c81.aarch64::container-tools:rhel8, buildah-1.22.3-2.module+el8.5.0+12582+56d94c81.ppc64le::container-tools:rhel8, buildah-1.22.3-2.module+el8.5.0+12582+56d94c81.s390x::container-tools:rhel8 +47
  • RHSA-2021:2437 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 packages and security update
    • Red Hat OpenShift Container Platform 4.8 afterburn-5.0.0-1.rhaos4.8.el8, atomic-openshift-service-idler-4.8.0-202106281541.p0.git.39cfc66.assembly.stream.el8, butane-0.12.1-1.rhaos4.8.el8 +47
  • RHSA-2021:2438 Released 2021-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.8.2 bug fix and security update
    • Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
  • RHSA-2021:1150 Released 2021-04-20 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.7 security update
    • Red Hat OpenShift Container Platform 4.7 cri-o-1.20.2-6.rhaos4.7.gitf1d5201.el7, cri-o-1.20.2-6.rhaos4.7.gitf1d5201.el8, openshift-4.7.0-202104090228.p0.git.97111.77863f8.el7 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 16.2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:4154
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2022:7954, RHSA-2022:7955, RHSA-2022:8008
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:1150
Red Hat OpenShift Container Platform 4.8Fixed RHSA-2021:2437, RHSA-2021:2438
Not affected: 6 products
  • Red Hat Cluster Application Migration
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.8
  • Red Hat OpenShift Virtualization 2
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-20291
  2. 2026-10-03 Alias added: GHSA-7qw8-847f-pggm

References

Exploit 1

Patch 1

Advisory 5

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences