CVE-2020-13846
published 2020-07-14CVE-2020-13846: Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
1.34%
68.0th percentile
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | singularity-container | < singularity-container 3.9.5+ds1-2 (sid) | singularity-container 3.9.5+ds1-2 (sid) |
| github.com | sylabs_singularity | >= 3.5.0 < 3.6.0 | 3.6.0 |
| sylabs | singularity | 3.5.0 – 3.5.3 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-13846: singularity-container - Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code...
vendor_debian·2020·CVSS 7.5
CVE-2020-13846 [HIGH] CVE-2020-13846: singularity-container - Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code...
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
Scope: local
sid: resolved (fixed in 3.9.5+ds1-2)
OSV
"Verify All" Returns Success Despite Validation Failures in Singularity
osv·2021-12-20
CVE-2020-13846 [HIGH] "Verify All" Returns Success Despite Validation Failures in Singularity
"Verify All" Returns Success Despite Validation Failures in Singularity
### Impact
The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.
The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0` are returned.
Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.
```
$ singularity verify -a image.sif
WARNING: Missing signature for SIF descriptor 2 (JSON.Generic)
WARNING: Missing signature for SIF descriptor 3 (FS)
Container is signed by 1 k
GHSA
"Verify All" Returns Success Despite Validation Failures in Singularity
ghsa·2021-12-20
CVE-2020-13846 [HIGH] "Verify All" Returns Success Despite Validation Failures in Singularity
"Verify All" Returns Success Despite Validation Failures in Singularity
### Impact
The `--all / -a` option to `singularity verify` returns success even when some objects in a SIF container are not signed, or cannot be verified.
The SIF objects that are not verified are reported in `WARNING` log messages, but a `Container Verified` message and exit code of `0` are returned.
Workflows that verify a container using `--all / -a` and use the exit code as an indicator of success are vulnerable to running SIF containers that have unsigned, or modified, objects that may be exploited to introduce malicious behavior.
```
$ singularity verify -a image.sif
WARNING: Missing signature for SIF descriptor 2 (JSON.Generic)
WARNING: Missing signature for SIF descriptor 3 (FS)
Container is signed by 1 k
OSV
CVE-2020-13846: Sylabs Singularity 3
osv·2020-07-14·CVSS 7.5
CVE-2020-13846 [HIGH] CVE-2020-13846: Sylabs Singularity 3
Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlhttps://github.com/hpcng/singularity/security/advisories/GHSA-6w7g-p4jh-rf92https://medium.com/sylabshttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.htmlhttps://github.com/hpcng/singularity/security/advisories/GHSA-6w7g-p4jh-rf92https://medium.com/sylabs
2020-07-14
Published