PT-2022-24831 · Sylabs+2 · Sif+2

Tri-Adam · Published 2022-10-06 · Updated 2024-06-20 · CVE-2022-39237

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions syslabs/sif versions prior to 2.8.1

Description The issue concerns the verification of digital signatures in the Singularity Image Format (SIF) reference implementation. Specifically, the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. Users are encouraged to upgrade to a version where this issue is fixed. For users unable to upgrade, it is recommended to independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

Recommendations For versions prior to 2.8.1, upgrade to version 2.8.1 or later. As a temporary workaround for users unable to upgrade, consider independently validating the hash algorithm(s) used for metadata digest(s) and signature hash to ensure they are cryptographically secure.

Exploit

Fix

Improper Verification of Cryptographic Signature

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-347

CWE-327

Related Identifiers

CVE-2022-39237

GHSA-M5M3-46GJ-WCH8

GO-2022-1045

OPENSUSE-SU-2023:0018-1

OPENSUSE-SU-2023_0018-1

OPENSUSE-SU-2024:12389-1

OPENSUSE-SU-2024:14059-1

Affected Products

Debian

Suse

Sif

References · 35

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39237.json · Exploit
• https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39237 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-39237 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39237 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39237 · Vendor Advisory
• https://security.gentoo.org/glsa/202210-19 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m5m3-46gj-wch8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/cve-2004-2761 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39237 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14059-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1045 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0018-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/cve-2005-4900 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12389-1 · Vendor Advisory