Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Skopeo may run out of memory with crafted files

published 4 years ago
Summary

The Skopeo tool can be forced to use unlimited memory when it processes specially made archive files, which could slow down or crash the system. This happens because it does not limit the size of file headers it reads. Updating Skopeo to the latest version fixes the issue by adding a reasonable size limit.

What to do
  • Update azure skopeo to version 1.14.4-1.
Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure skopeo < 1.14.4-1
Fix: upgrade to 1.14.4-1
Original advisory text
CVE-2022-2879 affecting package skopeo for versions less than 1.14.4-1
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published14 Oct 2022
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-41787 · OSV
Track software like this
Free during beta