PT-2019-15928 · Sylabs+1 · Singularity+1

Published 2019-12-18 · Updated 2024-06-15 · CVE-2019-19724

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Singularity versions 3.3.0 through 3.5.1

Description The issue arises from insecure permissions (777) being set on $HOME/.singularity when it is newly created by Singularity. This could lead to an information leak and malicious redirection of operations performed against Sylabs cloud services.

Recommendations For Singularity versions 3.3.0 through 3.5.1, consider changing the permissions of $HOME/.singularity to a more secure setting to prevent potential information leaks and malicious activities. As a temporary workaround, restrict access to the $HOME/.singularity directory until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2019-19724

GHSA-MJ73-5X75-9PHH

OPENSUSE-SU-2020:0057-1

OPENSUSE-SU-2020:1037-1

OPENSUSE-SU-2020_0057-1

OPENSUSE-SU-2020_1037-1

OPENSUSE-SU-2024:11384-1

Affected Products

Singularity

Suse

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2019-19724 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11384-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-19724 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0057-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1037-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mj73-5x75-9phh · Vendor Advisory
• https://github.com/sylabs/singularity · Note
• https://github.com/sylabs/singularity/releases/tag/v3.5.2 · Note
• https://github.com/sylabs/singularity/commit/2cda4981812c29f0fb11d3ea6aaf6139f665a631 · Note
• https://suse.com/security/cve/CVE-2018-12021 · Note
• https://bugzilla.suse.com/1174152 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/5J64YUTNVIDFS452EE467OIF75VV5BVJ · Note
• https://suse.com/security/cve/CVE-2020-13846 · Note