CVE-2022-39237

Name	CVE-2022-39237
Description	syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1023570

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-sylabs-sif (PTS)	bullseye	1.0.9-2.1	vulnerable
	bookworm	2.8.3-1	fixed
	sid, trixie	2.20.2-1	fixed
singularity-container (PTS)	sid	4.1.5+ds3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-sylabs-sif	source	(unstable)	2.8.3-1			1023570
singularity-container	source	(unstable)	3.10.3+ds1-1

Notes

[bullseye] - golang-github-sylabs-sif <no-dsa> (Minor issue)
https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254 (v2.8.1)
https://github.com/sylabs/sif/commit/a854038ce1f18237b81d505a1c3be6a60505db52 (v2.8.1)