GitHub Advisoryadvisory · Go

GHSA-mj73-5x75-9phh Singularity insecure permissions

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-19724
Ecosystem
Go
Packages
github.com/sylabs/singularity
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-276
Reviewed
2023-07-18

Affected packages

• Go github.com/sylabs/singularity: >= 3.3.0, < 3.5.2 → fixed in 3.5.2

Description

Insecure permissions (777) are set on `$HOME/.singularity` when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

Related

Alias · CVE (1)

  • CVE-2019-19724 Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could… vulnerability

Weakness · CWE (1)

  • CWE-276 Incorrect Default Permissions weakness

References