[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cve-CVE-2021-29499":3},{"id":4,"cve_id":5,"euvd_id":6,"summary":7,"published":8,"cvss_data":9,"is_remote":19,"cwes":20,"cpes":23,"technologies":26,"references":29,"score":35,"epss_score":36,"epss_percentile":37,"is_kev":38,"cisa_kev_date_added":39,"cisa_kev_due_date":39,"cisa_ssvc":40,"attack_mappings":46,"exploits":69},294005,"CVE-2021-29499","EUVD-2021-0940","Predictable SIF UUID Identifiers in github.com\u002Fsylabs\u002Fsif\n\n### Impact\n\nThe `siftool new` command and [func siftool.New()](https:\u002F\u002Fpkg.go.dev\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fpkg\u002Fsiftool#New) produce predictable UUID identifiers due to insecure randomness in the version of the `github.com\u002Fsatori\u002Fgo.uuid` module used as a dependency.\n\n### Patches\n\nA patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.\n\nThe patch is commit https:\u002F\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fcommit\u002F193962882122abf85ff5f5bcc86404933e71c07d\n\n### Workarounds\nUsers passing [CreateInfo struct](https:\u002F\u002Fpkg.go.dev\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fpkg\u002Fsif#CreateInfo) should ensure the `ID` field is generated using a version of `github.com\u002Fsatori\u002Fgo.uuid` that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:\n\n```\ngo get github.com\u002Fsatori\u002Fgo.uuid@75cca531ea763666bc46e531da3b4c3b95f64557\n```\n\n### References\n* https:\u002F\u002Fgithub.com\u002Fsatori\u002Fgo.uuid\u002Fissues\u002F73\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com\u002Fsylabs\u002Fsif](https:\u002F\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fissues\u002Fnew)\n* Email us at [security@sylabs.io](mailto:security@sylabs.io)\n","2021-05-18T18:30:00Z",{"cvss_v3.1":10},{"scope":11,"version":12,"baseScore":13,"attackVector":14,"baseSeverity":15,"vectorString":16,"integrityImpact":15,"userInteraction":17,"attackComplexity":18,"availabilityImpact":17,"privilegesRequired":17,"confidentialityImpact":17},"UNCHANGED","3.1",7.5,"NETWORK","HIGH","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N","NONE","LOW",true,[21,22],"CWE-330","CWE-340",[24,25],"cpe:2.3:a:sylabs:singularity_image_format:*:*:*:*:*:*:*:*","cpe:2.3:a:sylabs:sif:*:*:*:*:*:*:*:*",[27,28],"Sylabs Singularity Image Format","Sylabs Sif",[30,31,32,33,34],"https:\u002F\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fsecurity\u002Fadvisories\u002FGHSA-4gh8-x3vv-phhg","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2021-29499","https:\u002F\u002Fgithub.com\u002Fsatori\u002Fgo.uuid\u002Fissues\u002F73","https:\u002F\u002Fgithub.com\u002Fsylabs\u002Fsif\u002Fcommit\u002F193962882122abf85ff5f5bcc86404933e71c07d","https:\u002F\u002Fgithub.com\u002Fsylabs\u002Fsif",0.73,0.00958,0.61229,false,null,{"timestamp":39,"automatable":41,"tech_impact":42,"exploitation":43,"cisa_decision":44,"cisa_remediation_timeline":45},"no","partial","none",{},"FSU",[47,53,62],{"name":48,"source":49,"tactics":50,"technique_id":52},"Exploit Public-Facing Application","attack_vector",[51],"initial-access","T1190",{"name":54,"source":55,"cwe_ids":56,"tactics":57,"capec_ids":59,"technique_id":61},"Brute Force","capec",[21],[58],"credential-access",[60],"CAPEC-112","T1110",{"name":63,"source":55,"cwe_ids":64,"tactics":65,"capec_ids":66,"technique_id":68},"Private Keys",[21],[58],[67],"CAPEC-485","T1552.004",[70],{"link":30}]