GitHub Advisoryadvisory · Go

GHSA-m5m3-46gj-wch8 SIF's Digital Signature Hash Algorithms Not Validated

MEDIUM Published 2022-10-06 Modified 2023-01-10 Official page ↗
Aliases
CVE-2022-39237
Ecosystem
Go
Packages
github.com/sylabs/sif/v2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-327, CWE-347
Reviewed
2022-10-06

Affected packages

• Go github.com/sylabs/sif/v2: < 2.8.1 → fixed in 2.8.1

Description

Impact The `github.com/sylabs/sif/v2/pkg/integrity` package does not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. Patches A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. The patch is commit https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa Workarounds Users may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure. References • CVE-2004-2761 • CVE-2005-4900 For more information If you have any questions or comments about this advisory: • Open an issue in github.com/sylabs/sif • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-39237 syslabs/sif is the Singularity Image Format (SIF) reference implementation. vulnerability

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References