CVE-2022-23538
published 2023-01-17CVE-2022-23538: github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is…
PriorityP344high7.6CVSS 3.1
AVNACLPRLUIRSCCHILAN
EPSS
0.71%
49.7th percentile
github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularity Enterprise 1.x installation, or third party server implementing this flow. Interaction with Singularity Enterprise 2.x, and Singularity Container Services (cloud.sylabs.io), does not trigger the vulnerable flow. We encourage all users to update. Users who interact with a Singularity Enterprise 1.x installation, using a 3rd party S3 storage service, are advised to revoke and recreate their authentication tokens within Singularity Enterprise. There is no workaround available at this time.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | singularity-container | < singularity-container 3.11.0+ds1-1 (sid) | singularity-container 3.11.0+ds1-1 (sid) |
| github.com | sylabs_scs-library-client | >= 0 < 1.3.4 | 1.3.4 |
| github.com | sylabs_scs-library-client | >= 1.4.0 < 1.4.2 | 1.4.2 |
| sylabs | scs-library-client | < 1.34 | 1.34 |
| sylabs | scs-library-client | — | — |
| sylabs | singularity_container_services_library | — | — |
| sylabs | singularity_container_services_library | — | — |
| sylabs | singularity_container_services_library | — | — |
| sylabs | singularity_container_services_library | — | — |
CVSS provenance
nvdv3.17.6HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
osv7.6HIGH
vendor_debian5.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Leaked user credentials in github.com/sylabs/scs-library-client
osv·2023-02-01
CVE-2022-23538 Leaked user credentials in github.com/sylabs/scs-library-client
Leaked user credentials in github.com/sylabs/scs-library-client
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider.
OSV
scs-library-client may leak user credentials to third-party service via HTTP redirect
osv·2023-01-20
CVE-2022-23538 [MEDIUM] scs-library-client may leak user credentials to third-party service via HTTP redirect
scs-library-client may leak user credentials to third-party service via HTTP redirect
### Impact
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download.
Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user.
The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularit
GHSA
scs-library-client may leak user credentials to third-party service via HTTP redirect
ghsa·2023-01-20
CVE-2022-23538 [MEDIUM] CWE-522 scs-library-client may leak user credentials to third-party service via HTTP redirect
scs-library-client may leak user credentials to third-party service via HTTP redirect
### Impact
When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download.
Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user.
The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when communicating with a Singularit
OSV
CVE-2022-23538: github
osv·2023-01-17·CVSS 7.6
CVE-2022-23538 [HIGH] CVE-2022-23538: github
github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when commun
Debian
CVE-2022-23538: singularity-container - github.com/sylabs/scs-library-client is the Go client for the Singularity Contai...
vendor_debian·2022·CVSS 5.2
CVE-2022-23538 [MEDIUM] CVE-2022-23538: singularity-container - github.com/sylabs/scs-library-client is the Go client for the Singularity Contai...
github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is used to pull a container image, with authentication, the HTTP Authorization header sent by the client to the library service may be incorrectly leaked to an S3 backing storage provider. This occurs in a specific flow, where the library service redirects the client to a backing S3 storage server, to perform a multi-part concurrent download. Depending on site configuration, the S3 service may be provided by a third party. An attacker with access to the S3 service may be able to extract user credentials, allowing them to impersonate the user. The vulnerable multi-part concurrent download flow, with redirect to S3, is only used when commun
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/sylabs/scs-library-client/commit/68ac4cab5cda0afd8758ff5b5e2e57be6a22fcfahttps://github.com/sylabs/scs-library-client/commit/b5db2aacba6bf1231f42dd475cc32e6355ab47b2https://github.com/sylabs/scs-library-client/commit/eebd7caaab310b1fa803e55b8fc1acd9dcd2d00chttps://github.com/sylabs/scs-library-client/security/advisories/GHSA-7p8m-22h4-9pj7https://github.com/sylabs/scs-library-client/commit/68ac4cab5cda0afd8758ff5b5e2e57be6a22fcfahttps://github.com/sylabs/scs-library-client/commit/b5db2aacba6bf1231f42dd475cc32e6355ab47b2https://github.com/sylabs/scs-library-client/commit/eebd7caaab310b1fa803e55b8fc1acd9dcd2d00chttps://github.com/sylabs/scs-library-client/security/advisories/GHSA-7p8m-22h4-9pj7
2023-01-17
Published