Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-13847

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.

Published

2020-07-14T18:15:14.573

Last Modified

2024-11-21T05:01:59.760

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

10.0

Impact Score

2.9

Weaknesses

Type: Primary
CWE-354

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sylabs	singularity	≤ 3.5.0	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link ([email protected])
https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v Third Party Advisory ([email protected])
https://medium.com/sylabs Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://medium.com/sylabs Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)