CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13846
https://notcve.org/view.php?id=CVE-2020-13846
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code. Sylabs Singularity versiones 3.5.0 hasta 3.5.3, presenta un fallo al reportar un error en un Código de Estado • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html https://github.com/hpcng/singularity/security/advisories/GHSA-6w7g-p4jh-rf92 https://medium.com/sylabs •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13845
https://notcve.org/view.php?id=CVE-2020-13845
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. Sylabs Singularity versiones 3.0 hasta 3.5, presenta una Comprobación Inapropiada de un Valor de Comprobación de Integridad. La integridad de la imagen no es comprobada cuando una política ECL es aplicada. • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c https://medium.com/sylabs • CWE-347: Improper Verification of Cryptographic Signature CWE-354: Improper Validation of Integrity Check Value •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13847
https://notcve.org/view.php?id=CVE-2020-13847
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file. Sylabs Singularity versiones 3.0 hasta 3.5, carece de soporte para una Comprobación de Integridad. Los comandos de firma y verificación de Singularity no firman metadatos encontrados en el encabezado global o en los descriptores de objetos de datos de un archivo SIF • http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v https://medium.com/sylabs • CWE-354: Improper Validation of Integrity Check Value •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19724
https://notcve.org/view.php?id=CVE-2019-19724
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services. Los permisos no seguros (777) se establecen en $HOME/.singularity cuando son creados nuevamente por Singularity (versiones 3.3.0 hasta 3.5.1), lo que podría conllevar a un filtrado de información y un redireccionamiento malicioso de las operaciones realizadas contra los servicios en la nube de Sylabs. • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html https://github.com/sylabs/singularity/releases/tag/v3.5.2 • CWE-276: Incorrect Default Permissions •
CVSS: 9.0EPSS: 0%CPEs: 10EXPL: 1CVE-2019-11328
https://notcve.org/view.php?id=CVE-2019-11328
An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host. Se encontró un problema en Singularity versión 3.1.0 hasta la 3.2.0-rc2, un usuario malicioso con acceso local de red hacia el sistema host (por ejemplo, ssh) podría atacar esta vulnerabilidad debido a permisos no seguros que permiten a un usuario editar archivos dentro de `/run/singularity/instances/sing//`. La manipulación de esos archivos puede cambiar el comportamiento del programa starter-suid cuando las peticiones se unen, lo que conlleva a una posible escalada de privilegios en el host. • http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00028.html http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html http://www.openwall.com/lists/oss-security/2019/05/16/1 http://www.securityfocus.com/bid/108360 https://github.com/sylabs/singularity/releases/tag/v3.2.0 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3TPL5OOTIZEI4H6IQBCCISBARJ6WL3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject& • CWE-732: Incorrect Permission Assignment for Critical Resource •