PT-2018-10947 · Sylabs+2 · Singularity+2

Godloved · Published 2018-07-05 · Updated 2024-06-15 · CVE-2018-12021

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Singularity versions 2.3.0 through 2.5.1

Description The issue is related to incorrect access control on systems that support the overlay file system. A malicious user can exploit specific Singularity features to access sensitive information when the overlay option is used.

Recommendations For versions 2.3.0 through 2.5.1, consider disabling the overlay file system option as a temporary workaround until a patch is available. Restrict access to sensitive information and Singularity features that can be exploited to minimize the risk of unauthorized access.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-12021

GHSA-4X32-H296-RG6J

OPENSUSE-SU-2018:1969-1

OPENSUSE-SU-2018_3316-1

OPENSUSE-SU-2019:0095-1

OPENSUSE-SU-2024:11384-1

USN-4840-1

Affected Products

Singularity

Suse

Ubuntu

References · 31

• https://ubuntu.com/security/notices/USN-4840-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-12021 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4840-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12021 · Security Note
• https://ubuntu.com/security/CVE-2018-19295 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-12021 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2018:1969-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4x32-h296-rg6j · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11384-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-12021 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2019:0095-1 · Vendor Advisory
• https://github.com/singularityware/singularity/releases/tag/2.5.2 · Note
• https://github.com/singularityware/singularity · Note
• https://suse.com/security/cve/CVE-2019-11328 · Note