denial of service in github.com/ulikunitz/xz
Published Apr 28, 2021
7.5
HIGHCVSS 3.1
EPSS 1.44%
Description
xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.
Affected products
-
Affected
- < 0.5.8
- < 0.5.8
No data.
OADP-1.0-RHEL-8
oadp/oadp-velero-plugin-rhel8:1.0.1-5
Fixed · RHSA-2022:0687
OpenShift Service Mesh 2.0
servicemesh-0:2.0.9-3.el8
Fixed · RHSA-2022:1276
RHEL-8-CNV-4.8
container-native-virtualization/vm-import-operator-rhel8:v4.8.0-18
Fixed · RHSA-2021:2920
Red Hat OpenStack Platform 16.2
rhosp-rhel8-tech-preview/osp-director-operator:1.2.3-2
Fixed · RHSA-2022:2183
Migration Toolkit for Containers
openshift-migration-plugin-container
Affected
Migration Toolkit for Containers
rhmtc/openshift-migration-controller-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
multicloud-operators-application-container
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
multicloud-operators-channel-container
Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2
multicloud-operators-subscription
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
multicloud-operators-subscription-release
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/cluster-curator-controller-rhel8
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/clusterlifecycle-state-metrics-rhel8
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/multicloud-manager-rhel8
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/multiclusterhub-rhel9-operator
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/openshift-hive-rhel8
Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/search-collector-rhel8
Affected
Red Hat OpenShift Container Platform 4
buildah
Will not fix
Red Hat OpenShift Container Platform 4
cri-o
Not affected
Red Hat OpenShift Container Platform 4
openshift4/cnf-tests-rhel8
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/compliance-rhel8-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/file-integrity-rhel8-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-installer-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-baremetal-machine-controllers-rhel9
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-cluster-node-tuning-rhel9-operator
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-docker-builder
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-installer-artifacts
Fix deferred
Red Hat OpenShift Container Platform 4
openshift4/ose-machine-config-operator
Not affected
Red Hat OpenShift Container Platform 4
podman
Will not fix
Red Hat OpenShift Container Platform 4
skopeo
Will not fix
Red Hat OpenShift Container Platform Assisted Installer 1
rhai-tech-preview/assisted-installer-agent-rhel8
Not affected
Red Hat OpenShift Container Platform Assisted Installer 1
rhai-tech-preview/assisted-installer-reporter-rhel8
Not affected
Red Hat OpenShift Container Platform Assisted Installer 1
rhai-tech-preview/assisted-installer-rhel8
Not affected
Red Hat OpenShift Virtualization 2
container-native-virtualization/vm-import-controller
Not affected
Red Hat OpenShift Virtualization 2
container-native-virtualization/vm-import-controller-rhel8
Not affected
Red Hat OpenShift Virtualization 2
hyperconverged-cluster-operator-container
Not affected
Red Hat OpenShift Virtualization 2
hyperconverged-cluster-webhook-container
Not affected
Red Hat OpenShift Virtualization 2
kubemacpool-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-apiserver-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-cloner-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-controller-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-importer-container
Affected
Red Hat OpenShift Virtualization 2
virt-cdi-operator-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-uploadproxy-container
Not affected
Red Hat OpenShift Virtualization 2
virt-cdi-uploadserver-container
Affected
Red Hat OpenShift Virtualization 2
vm-import-operator-container
Not affected
Red Hat OpenShift Virtualization 2
vm-import-virtv2v-container
Not affected
Red Hat OpenStack Platform 16.2
osp-director-provisioner-container
Affected
Red Hat OpenStack Platform 16.2
rhosp-rhel8/osp-director-downloader
Will not fix
Red Hat Quay 3
quay/clair-rhel8
Affected
Red Hat Quay 3
quay/quay-builder-rhel8
Affected
Red Hat Quay 3
quay/quay-operator-rhel8
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| OADP-1.0-RHEL-8 | oadp/oadp-velero-plugin-rhel8:1.0.1-5 | Fixed | RHSA-2022:0687 |
| OpenShift Service Mesh 2.0 | servicemesh-0:2.0.9-3.el8 | Fixed | RHSA-2022:1276 |
| RHEL-8-CNV-4.8 | container-native-virtualization/vm-import-operator-rhel8:v4.8.0-18 | Fixed | RHSA-2021:2920 |
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8-tech-preview/osp-director-operator:1.2.3-2 | Fixed | RHSA-2022:2183 |
| Migration Toolkit for Containers | openshift-migration-plugin-container | Affected | n/a |
| Migration Toolkit for Containers | rhmtc/openshift-migration-controller-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | multicloud-operators-application-container | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | multicloud-operators-channel-container | Will not fix | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | multicloud-operators-subscription | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | multicloud-operators-subscription-release | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/cluster-curator-controller-rhel8 | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/clusterlifecycle-state-metrics-rhel8 | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multicloud-manager-rhel8 | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multiclusterhub-rhel9-operator | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/openshift-hive-rhel8 | Fix deferred | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/search-collector-rhel8 | Affected | n/a |
| Red Hat OpenShift Container Platform 4 | buildah | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | cri-o | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/cnf-tests-rhel8 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/compliance-rhel8-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/file-integrity-rhel8-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-installer-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-machine-controllers-rhel9 | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-node-tuning-rhel9-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-docker-builder | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer-artifacts | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-machine-config-operator | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | podman | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | skopeo | Will not fix | n/a |
| Red Hat OpenShift Container Platform Assisted Installer 1 | rhai-tech-preview/assisted-installer-agent-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform Assisted Installer 1 | rhai-tech-preview/assisted-installer-reporter-rhel8 | Not affected | n/a |
| Red Hat OpenShift Container Platform Assisted Installer 1 | rhai-tech-preview/assisted-installer-rhel8 | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | container-native-virtualization/vm-import-controller | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | container-native-virtualization/vm-import-controller-rhel8 | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | hyperconverged-cluster-operator-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | hyperconverged-cluster-webhook-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | kubemacpool-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-apiserver-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-cloner-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-controller-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-importer-container | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-operator-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-uploadproxy-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | virt-cdi-uploadserver-container | Affected | n/a |
| Red Hat OpenShift Virtualization 2 | vm-import-operator-container | Not affected | n/a |
| Red Hat OpenShift Virtualization 2 | vm-import-virtv2v-container | Not affected | n/a |
| Red Hat OpenStack Platform 16.2 | osp-director-provisioner-container | Affected | n/a |
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/osp-director-downloader | Will not fix | n/a |
| Red Hat Quay 3 | quay/clair-rhel8 | Affected | n/a |
| Red Hat Quay 3 | quay/quay-builder-rhel8 | Affected | n/a |
| Red Hat Quay 3 | quay/quay-operator-rhel8 | Affected | n/a |
github.com/ulikunitz/xz
Go
Introduced 0 Fixed 0.5.8
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/ulikunitz/xz | 0 | 0.5.8 |
Remediation
Red Hat statement
In OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM) and Red Hat Advanced Cluster Management for Kubernetes (RHACM) the affected components are behind OpenShift OAuth authentication, therefore the impact is low. In OCP before 4.7 the buildah, skopeo and podman packages include vulnerable version of github.com/ulikunitz/xz, but these OCP releases are already in the Maintenance Phase of the support, hence affected components are marked as wontfix. This may be fixed in the future.
References (10)
- https://access.redhat.com/security/cve/CVE-2021-29482 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1954368 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0896 Advisory
- https://github.com/advisories/GHSA-25xm-hr59-7c27 Advisory
- https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b x_refsource_MISCPatchThird Party Advisory
- https://github.com/ulikunitz/xz/issues/35
- https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27 x_refsource_CONFIRMThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-29482
- https://pkg.go.dev/vuln/GO-2020-0016
- https://www.cve.org/CVERecord?id=CVE-2021-29482
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-29482 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1954368 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0896 | Advisory | |
| https://github.com/advisories/GHSA-25xm-hr59-7c27 | Advisory | |
| https://github.com/ulikunitz/xz/commit/69c6093c7b2397b923acf82cb378f55ab2652b9b | x_refsource_MISCPatchThird Party Advisory | |
| https://github.com/ulikunitz/xz/issues/35 | ||
| https://github.com/ulikunitz/xz/security/advisories/GHSA-25xm-hr59-7c27 | x_refsource_CONFIRMThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2021-29482 | ||
| https://pkg.go.dev/vuln/GO-2020-0016 | ||
| https://www.cve.org/CVERecord?id=CVE-2021-29482 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub