CVE-2021-32635 — Improper Input Validation in Sylabs Singularity

CWE-20 — Improper Input ValidationCWE-923 — Improper Restriction of Communication Channel to Intended Endpoints6 documents5 sources
Severity
6.3MEDIUMNVD
EPSS
0.6%
top 29.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Sylabs SingularitySylabs Singularity
Timeline
PublishedMay 28
Latest updateJun 1

Description

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a vict…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages3 packages

▶Gogithub.com/sylabs_singularity3.7.2 — 3.7.4
▶CVEListV5sylabs/singularity>= 3.7.2, <= 3.7.3
▶NVDsylabs/singularity3.7.2, 3.7.3+1

🔴Vulnerability Details

4
GHSA
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint↗2021-06-01
▶
OSV
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint↗2021-06-01
▶
OSV
CVE-2021-32635: Singularity is an open source container platform↗2021-05-28
▶
CVEList
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint↗2021-05-28
▶

📋Vendor Advisories

1
Debian
CVE-2021-32635: singularity-container - Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dd...↗2021
▶
CVE-2021-32635 — Improper Input Validation | cvebase