CVE-2021-20291

Name of the Vulnerable Software and Affected Versions: github.com/containers/storage versions prior to 1.28.1

Description: A deadlock issue occurs when processing a container image with an invalid tar archive layer, causing the code to wait indefinitely for the tar unpacked stream. This can be exploited by an attacker to craft a malicious image, leading to a Denial of Service (DoS) when downloaded and stored by an application using containers/storage.

Recommendations: For versions prior to 1.28.1, update to version 1.28.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the github.com/containers/storage module until a patch is available. Avoid using the DecompressStream function on untrusted archives to minimize the risk of exploitation.