PT-2020-13726 · Sylabs+1 · Sylabs Singularity+1

Published 2020-07-14 · Updated 2024-06-15 · CVE-2020-13845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sylabs Singularity versions 3.0 through 3.5

Description The issue concerns improper validation of an integrity check value in Sylabs Singularity. Specifically, image integrity is not validated when an Execution Control List (ECL) policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature. This allows a malicious user to bypass the ECL by crafting an arbitrary payload that will be permitted to run, even without access to the private key associated with the fingerprint(s) configured in the ECL.

Recommendations For Sylabs Singularity versions 3.0 through 3.5, upgrade to version 3.6.0 to address the issue. Note that version 3.6.0 uses a new signature format incompatible with earlier versions. To ease the transition, the legacyinsecure option can be set to legacyinsecure = true in ecl.toml to allow verification of older, insecure legacy signatures, but this should only be used temporarily.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

CWE-354

Related Identifiers

CVE-2020-13845

GHSA-PMFR-63C2-JR5C

OPENSUSE-SU-2020:1011-1

OPENSUSE-SU-2020:1037-1

OPENSUSE-SU-2020:1100-1

OPENSUSE-SU-2020_1011-1

OPENSUSE-SU-2020_1037-1

OPENSUSE-SU-2024:11384-1

Affected Products

Suse

Sylabs Singularity

References · 36

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13845 · Security Note
• https://osv.dev/vulnerability/GHSA-pmfr-63c2-jr5c · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1037-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1100-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11384-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1011-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13845 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13845 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13845 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13845 · Vendor Advisory
• https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c · Note
• https://suse.com/security/cve/CVE-2020-25039 · Note