PT-2020-13728 · Sylabs+1 · Sylabs Singularity+1

Dtrudg + 1 · Published 2020-07-14 · Updated 2024-06-15 · CVE-2020-13847

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Sylabs Singularity versions 3.0 through 3.5

Description The issue concerns a lack of support for an Integrity Check in Sylabs Singularity. Specifically, the sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.

Recommendations For versions 3.0 through 3.5, consider implementing additional integrity checks on SIF files to ensure their authenticity and integrity until a patch is available. As a temporary workaround, restrict the use of unverified SIF files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2020-13847

GHSA-M7J2-9565-4H9V

OPENSUSE-SU-2020:1011-1

OPENSUSE-SU-2020:1037-1

OPENSUSE-SU-2020:1100-1

OPENSUSE-SU-2020_1011-1

OPENSUSE-SU-2020_1037-1

OPENSUSE-SU-2024:11384-1

Affected Products

Suse

Sylabs Singularity

References · 35

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13847 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1037-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13847 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1100-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13847 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11384-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1011-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13847 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html · Vendor Advisory
• https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v · Note
• https://suse.com/security/cve/CVE-2020-25039 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/MUCKOMJKYSUD3KFNFD7KCBEF323WWHLF · Note