CVE-2020-13845

Name
CVE-2020-13845
Description
Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Third Party Advisory https://medium.com/sylabs
Third Party Advisory https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
SUSE http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:* singularity >= 3.0.0 <= 3.5.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status