CVE-2018-12021

Description

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.

CVSS Metrics

• v3.0•MEDIUM•Score: 6.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• v2.0•MEDIUM•Score: 6.8AV:N/AC:L/Au:S/C:C/I:N/A:N

EPSS Trends

Current EPSS score: 0.43%• Percentile: 63%

Techniques & Countermeasures

• CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

  The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

• github.com/hpcng•singularity

  ≥ 2.3.0, < 2.5.2

• sylabs•singularity

  ≥ 2.3.0, ≤ 2.5.1

References (4)

• https://github.com/singularityware/singularity/releases/tag/2.5.2
• http://www.openwall.com/lists/oss-security/2019/05/16/1
• https://nvd.nist.gov/vuln/detail/CVE-2018-12021
• https://github.com/singularityware/singularity