CVE-2021-29499
High
Description
SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSylabs Singularity Image Format
PublishedMay 7, 2021
First seenMay 7, 2021
Weakness typeCWE-330CWE-330
How to fix
Update
- sylabs singularity_image_format1.2.3 or later
- github.com/sylabs/sif1.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sylabs singularity_image_format | v < 1.2.3 | 1.2.3 |
| github.com/sylabs/sifGo | v < 1.2.3 | 1.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.