// For flags

CVE-2022-39237

Digital Signature Hash Algorithms Not Validated in sylabs/sif

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

syslabs/sif es la implementación de referencia del Formato de Imagen de Singularidad (SIF). En las versiones anteriores a 2.8.1, el paquete "github.com/sylabs/sif/v2/pkg/integrity" no verificaba que los algoritmos hash usados fueran criptográficamente seguros cuando eran verificadas las firmas digitales. Se presenta un parche disponible en versiones posteriores a v2.8.1 incluyéndola, del módulo. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizarse pueden comprobar de forma independiente que los algoritmos de hash usados para el resumen de metadatos y el hash de la firma son criptográficamente seguros

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-10-06 CVE Published
  • 2024-05-27 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  • CWE-347: Improper Verification of Cryptographic Signature
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sylabs
Search vendor "Sylabs"
 Singularity Image Format
Search vendor "Sylabs" for product "Singularity Image Format"
 < 2.8.1
Search vendor "Sylabs" for product "Singularity Image Format" and version " < 2.8.1"
-
Affected