Red Hat Security Advisory: skopeo security and bug fix update

Fixed packages 4

Vulnerabilities 2

• Medium 6.5
  CVE-2021-20291

  Improper Locking in github.com/containers/storage

  A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…

  buildah golang-github-containers-storage golang-github-containers-storage github.com/containers/storage Debian Ubuntu Azure Linux Go
  Apr 1, 2021
• Unscored —
  CVE-2021-33198

  Panic on inputs with large exponents in math/big

  In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

  go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  Aug 2, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1988128
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1989575
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7955.json
• report
  https://access.redhat.com/security/cve/CVE-2021-20291
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20291
• article
  https://unit42.paloaltonetworks.com/cve-2021-20291/
• report
  https://access.redhat.com/security/cve/CVE-2021-33198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33198
• article
  https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI