Medium ELSA-2022-7955 2 CVEs

Moderate: skopeo security and bug fix update (Oracle Linux 9)

Published Nov 22, 2022 · Updated Nov 22, 2022

Ecosystem: Oracle Linux

Summary

[2:1.9.2-1]
- update to https://github.com/containers/skopeo/releases/tag/v1.9.2
- Related: #2061316

[2:1.9.1-1]
- update to https://github.com/containers/skopeo/releases/tag/v1.9.1
- Related: #2061316

[2:1.9.0-1]
- update to https://github.com/containers/skopeo/releases/tag/v1.9.0
- Related: #2061316

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	skopeo	2:1.9.2-1.el9
Oracle Linux · 9	skopeo-tests	2:1.9.2-1.el9

Vulnerabilities 2

Medium 6.5

CVE-2021-20291

Improper Locking in github.com/containers/storage

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…

buildah golang-github-containers-storage golang-github-containers-storage github.com/containers/storage Debian Ubuntu Azure Linux Go

Apr 1, 2021
Unscored —

CVE-2021-33198

Panic on inputs with large exponents in math/big

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go

Aug 2, 2021