CVE-2020-25040

Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
sylabssingularity
𝑥
≤ 3.6.2
opensuseleap
15.1
opensuseleap
15.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
singularity-container
sid
4.1.5+ds3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
singularity-container
noble
needs-triage
mantic
dne
lunar
dne
kinetic
dne
jammy
dne
impish
dne
hirsute
dne
groovy
dne
focal
dne
bionic
needs-triage
xenial
dne
trusty
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00070.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00088.html
https://github.com/hpcng/singularity/security/advisories/GHSA-jv9c-w74q-6762
https://medium.com/sylabs
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00070.html
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00088.html
https://github.com/hpcng/singularity/security/advisories/GHSA-jv9c-w74q-6762
https://medium.com/sylabs