CVEvulnerability
CVE-2020-13845
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-07-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-347, CWE-354
Description
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
Affected configurations
• sylabs singularity (>= 3.0.0 <= 3.5.0)
Related
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link
- https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c Third Party Advisory
- https://medium.com/sylabs Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html Broken Link
- https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c Third Party Advisory
- https://medium.com/sylabs Third Party Advisory