Input validation error in Singularity - CVE-2018-19295
Published: January 14, 2019
Vulnerability identifier: #VU16969
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19295
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to perform improper input validation attack.
The vulnerability exists due to insufficient validation of user-supplied input. A local attacker can supply specially crafted application and cause the service to crash or execute arbitrary code with elevated privileges.
Affected software
Singularity
Opensuse
Fedora
singularity
Opensuse
Fedora
singularity
How to mitigate CVE-2018-19295
Update to version 2.6.1.
Singularity - update to 2.6.1
singularity - update to 2.6.1-1.1.fc29
singularity - update to 2.6.1-1.1.fc29