CVE-2021-29499 - CVE House
Back to Database
Status published High CVE-2021-29499

Predictable SIF UUID Identifiers

Vulnerability Description

SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the `ID` field is generated using a version of `github.com/satori/go.uuid` that is not vulnerable to this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29499

Credits & Attribution

No credits recorded in the NVD database.

References

More from sylabs

View All →
CVE-2025-64750
Singluarity ineffectively applies of selinux / apparmor LSM process labels
Medium 4.5
CVE-2022-39237
Digital Signature Hash Algorithms Not Validated in sylabs/sif
Medium 6.3
CVE-2022-23538
User credentials leaked to third-party service via HTTP redirect in scs-library-client
Medium 5.2
CVE-2021-33622
Sylabs Singularity 3.5.x and 3.6.x, and SingularityPRO before 3.5-8, has...
Critical 9.8
CVE-2021-33027
Sylabs Singularity Enterprise through 1.6.2 has Insufficient Entropy in a...
Critical 9.8

Affected Vendor

Affected Software

sif
Vulnerable Versions:
<= 1.2.2

Timeline

Official Publish: May 7th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.