GHSA-wqcr-7rf3-f64m Singluarity: Incorrect path matching for 'limit container paths' directive

• Go github.com/sylabs/singularity/v4: < 4.4.2 → fixed in 4.4.2 • Go github.com/sylabs/singularity: <= 3.1.1 (no fix yet)

Impact The `limit container paths` directive in `singularity.conf` is intended to allow a system administrator limit the paths from which containers can be run, under setuid mode. Due to incorrect matching of a path string, sibling directories with similar names may incorrectly be allowed. For example, the configuration: ``` limit container paths = /data/safe ``` Will also allow containers in `/data/safe-but-unsafe` to be run. Patches This issue is patched in SingularityCE 4.4.2 and SingularityPRO 4.3.9 / 4.1.14 Workarounds If you do not use the `limit container paths` functionality, then this issue does not affect your installation. If you do use the `limit container paths` functionality then you must update. Please also review the documented limitations when user namespaces are enabled [1].