Every CVE Search/ Get API key

CVE-2021-29499

Predictable SIF UUID Identifiers

7.5 HighFix available

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

0.96%Up 0.5 points since May 8, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Predictable SIF UUID Identifiers

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
CVE-2021-29499
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-330
Updated
2026-11-02
EUVDEUVD-2021-0940 7.5

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
EUVD-2021-0940
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-4gh8-x3vv-phhg 7.5

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Impact

The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency.

Patches

A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.

The patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d

Workarounds

Users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-4gh8-x3vv-phhg
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-330, CWE-340
Updated
2026-11-02
NVD 7.5

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
CVE-2021-29499
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-330
Updated
2026-11-02
OSV 7.5

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
CVE-2021-29499
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-29499 7.5

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
DEBIAN-CVE-2021-29499
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-4gh8-x3vv-phhg 7.5

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Impact

The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency.

Patches

A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade.

The patch is commit https://github.com/sylabs/sif/commit/193962882122abf85ff5f5bcc86404933e71c07d

Workarounds

Users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue. Unfortunately, the latest tagged release is vulnerable to this issue. One way to obtain a non-vulnerable version is:

go get github.com/satori/go.uuid@75cca531ea763666bc46e531da3b4c3b95f64557

References

For more information

If you have any questions or comments about this advisory:

Record
GHSA-4gh8-x3vv-phhg
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-330, CWE-340
Updated
2026-11-02
OSVUBUNTU-CVE-2021-29499 7.5

SIF is an open source implementation of the Singularity Container Image Format. The siftool new command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the github.com/satori/go.uuid module used as a dependency. A patch is available in version >= v1.2.3 of the module. Users are encouraged to upgrade. As a workaround, users passing CreateInfo struct should ensure the ID field is generated using a version of github.com/satori/go.uuid that is not vulnerable to this issue.

Record
UBUNTU-CVE-2021-29499
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2022-0912 No score

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Predictable SIF UUID Identifiers in github.com/sylabs/sif

Record
GO-2022-0912
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/sylabs/sif
Go
 before 1.2.3
1.2.3
golang-github-sylabs-sif
Debian:12
 before 2.3.1-2
2.3.1-2
golang-github-sylabs-sif
Debian:13
 before 2.3.1-2
2.3.1-2
golang-github-sylabs-sif
Debian:14
 before 2.3.1-2
2.3.1-2
singularity-container
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.3.1-22.3.2-12.4.1-12.4.2-22.4.2-32.4.2-42.4.2-4ubuntu0.1~esm1
 None known
golang-github-sylabs-sif
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.0.9-1
 None known
golang-github-sylabs-sif
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.0.9-2.11.0.9-2.1build11.0.9-2.1ubuntu0.1
 None known
golang-github-sylabs-sif
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.8.3-2build12.8.3-2ubuntu0.24.04.12.8.3-2ubuntu0.24.04.22.8.3-2ubuntu0.24.04.3
 None known
singularity-container
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
4.1.1+ds2-14.1.1+ds2-1build14.1.1+ds2-1ubuntu0.14.1.1+ds2-1ubuntu0.24.1.1+ds2-1ubuntu0.2+esm14.1.1+ds2-1ubuntu0.34.1.1+ds2-1ubuntu0.3+esm14.1.1+ds2-1ubuntu0.3+esm2
 None known
golang-github-sylabs-sif
Ubuntu:25.10
 All versions, plus listed versions
2.21.0-1
 None known
Show 4 moreShow less
Affected packages
PackageAffectedFixed
singularity-container
Ubuntu:25.10
 All versions, plus listed versions
4.1.5+ds4-1
 None known
golang-github-sylabs-sif
Ubuntu:26.10
 All versions, plus listed versions
2.23.0-12.24.1-1
 None known
singularity-container
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.1.5+ds4-1
 None known
golang-github-sylabs-sif
Ubuntu:Pro:26.04:LTS
 All versions, plus listed versions
2.21.0-12.21.0-1build12.23.0-12.23.0-1ubuntu0.26.04.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29499 is a high vulnerability (CVSS 7.5) in Sylabs Sif, published May 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in github.com/sylabs/sif 1.2.3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open