singularity

7 results · Clear filters · Feed

• High 8.7
  CVE-2024-23651

  BuildKit possible race condition with accessing subpaths from cache mounts

  BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Two malicious build steps running in parallel sharing the same cache mounts with subpaths could cause a race condition that can lead to file…

  moby BuildKit docker.io docker Ubuntu Alpine Go
  Jan 31, 2024
• High 8.2
  CVE-2020-15229

  Path traversal and files overwrite with unsquashfs

  Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host fi…

  hpcng singularity singularity github.com/sylabs/singularity Alpine Go
  Oct 14, 2020
• High 8.8
  CVE-2020-25040

  Insecure permissions on build temporary rootfs in Singularity

  Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 8.1
  CVE-2020-25039

  Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

  Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 7.5
  CVE-2020-13846

  "Verify All" Returns Success Despite Validation Failures in Singularity

  Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2020-13845

  Execution Control List (ECL) Is Insecure in Singularity

  Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file…

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2019-19724

  Singularity insecure permissions

  Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

  singularity github.com/sylabs/singularity Alpine Go
  Dec 18, 2019