CVE-2020-13845

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
sylabssingularity
3.0.0 ≤
𝑥
≤ 3.5.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
singularity-container
sid
4.1.5+ds3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
singularity-container
noble
needs-triage
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
eoan
ignored
bionic
needs-triage
xenial
dne
trusty
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c
https://medium.com/sylabs
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c
https://medium.com/sylabs