CVE-2020-13845

NameCVE-2020-13845
DescriptionSylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs965040

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
singularity-container (PTS)sid3.5.2+ds1-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
singularity-containersource(unstable)(unfixed)965040

Notes

https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c

Search for package or bug name: Reporting problems