Lucene search

K
osvGoogleOSV:GO-2021-0100
HistoryJul 28, 2021 - 6:08 p.m.

Denial of service via deadlock in github.com/containers/storage

2021-07-2818:08:05
Google
osv.dev
43
github
containers
storage
deadlock
denial of service
goroutine
decompress
archive

AI Score

6.3

Confidence

High

EPSS

0.005

Percentile

77.0%

Due to a goroutine deadlock, using github.com/containers/storage/pkg/archive.DecompressStream on a xz archive returns a reader which will hang indefinitely when Close is called. An attacker can use this to cause denial of service if they are able to cause the caller to attempt to decompress an archive they control.