CVE-2018-12021
Published: 5 July 2018
Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features.
From the Ubuntu Security Team
It was discovered that Singularity incorrectly handled access control. An attacker could possibly use this issue to obtain sensitive information.
Priority
Status
Package | Release | Status |
---|---|---|
singularity-container Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
bionic |
Released
(2.4.2-4ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
cosmic |
Not vulnerable
(2.5.2-2)
|
|
disco |
Not vulnerable
(2.6.1-2)
|
|
eoan |
Not vulnerable
(2.6.1-2)
|
|
focal |
Does not exist
|
|
groovy |
Does not exist
|
|
hirsute |
Does not exist
|
|
impish |
Does not exist
|
|
jammy |
Does not exist
|
|
kinetic |
Does not exist
|
|
lunar |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.5.2-1)
|
|
xenial |
Does not exist
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.5 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |