CVE-2020-13845

 

Published at: - 14-07-2020 08:15

Last modified: - 20-01-2023 09:09

Total changes: - 2

Description

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://medium.com/sylabs
• https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c
• openSUSE-SU-2020:1011-Broken Link
• openSUSE-SU-2020:1037-Broken Link
• openSUSE-SU-2020:1100-Broken Link

 

Keywords

NVD

 

CVE-2020-13845

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures