GHSA-4x32-h296-rg6j

Singularity Incorrect Access Control

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-12021

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/hpcng/singularity	>= 2.3.0, < 2.5.2	2.5.2

Details

As written in the advisory (Markdown source, shown as plain text).

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-12021 advisory
https://github.com/singularityware/singularity package
https://github.com/singularityware/singularity/releases/tag/2.5.2 web
http://www.openwall.com/lists/oss-security/2019/05/16/1 web