github.com/sylabs/singularity

8 results · Clear filters · Feed

• High 8.2
  CVE-2020-15229

  Path traversal and files overwrite with unsquashfs

  Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path traversal and the lack of path sanitization within `unsquashfs`, it is possible to overwrite/create any files on the host fi…

  hpcng singularity singularity github.com/sylabs/singularity Alpine Go
  Oct 14, 2020
• High 8.8
  CVE-2020-25040

  Insecure permissions on build temporary rootfs in Singularity

  Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 8.1
  CVE-2020-25039

  Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

  Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 7.5
  CVE-2020-13846

  "Verify All" Returns Success Despite Validation Failures in Singularity

  Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2020-13845

  Execution Control List (ECL) Is Insecure in Singularity

  Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file…

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2019-19724

  Singularity insecure permissions

  Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

  singularity github.com/sylabs/singularity Alpine Go
  Dec 18, 2019
• High 8.8
  CVE-2019-11328

  Incorrect Permission Assignment for Critical Resource in Singularity

  An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/s…

  github.com/sylabs/singularity Go
  May 14, 2019
• High 7.8
  CVE-2018-19295

  Sylabs Singularity Improper Input Validation

  Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.

  singularity-container github.com/sylabs/singularity Ubuntu Go
  Dec 17, 2018