CVE-2021-29499High· 7.5▾ TwilightPredictable SIF UUID Identifiers in github.com/sylabs/sif
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency.
A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.
The patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d
Users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:
go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557
If you have any questions or comments about this advisory:
github.com/sylabs/sif < 1.2.3Upgrade to a patched release:
github.com/sylabs/sif 1.2.3Connected by shared product, vendor, weakness, or advisory.
CVE-2020-15229High· 8.2Path traversal and files overwrite with unsquashfs in singularity
CVE-2020-13845High· 7.5Execution Control List (ECL) Is Insecure in Singularity
CVE-2020-25040High· 8.8Insecure permissions on build temporary rootfs in Singularity
CVE-2020-13846High· 7.5"Verify All" Returns Success Despite Validation Failures in Singularity
CVE-2021-32635Medium· 6.3Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
CVE-2026-47215Medium· 4.8SingularityCE and SingularityPRO are open source container platforms