MEDIUM6.5

GHSA-4x32-h296-rg6j

Singularity Incorrect Access Control

Quick fix

GHSA-4x32-h296-rg6j — github.com/hpcng/singularity: upgrade to the fixed version with the command below.

go get github.com/hpcng/singularity@v2.5.2

Details

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/hpcng/singularity

Introduced in: 2.3.0Fixed in: 2.5.2

Fixgo get github.com/hpcng/singularity@v2.5.2

References

https://nvd.nist.gov/vuln/detail/CVE-2018-12021[ADVISORY]
https://github.com/singularityware/singularity[PACKAGE]
https://github.com/singularityware/singularity/releases/tag/2.5.2[WEB]
http://www.openwall.com/lists/oss-security/2019/05/16/1[WEB]