singularity-container

9 results · Clear filters · Feed

• High 7.1
  CVE-2023-30549

  Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainer

  Apptainer is an open source container platform for Linux. There is an ext4 use-after-free flaw that is exploitable through versions of Apptainer < 1.1.0 and installations that include apptainer-suid < 1.1.8 on older operating systems where that CVE has not be…

  apptainer apptainer singularity-container apptainer Ubuntu Alpine Go
  Apr 25, 2023
• High 7.5
  CVE-2022-3064

  Excessive resource consumption in gopkg.in/yaml.v2

  Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

  gopkg.in/yaml.v2 gopkg.in/yaml.v2 singularity-container golang-github-coreos-discovery-etcd-io Debian Ubuntu Go
  Dec 27, 2022
• High 7.5
  CVE-2021-29499

  Predictable SIF UUID Identifiers

  SIF is an open source implementation of the Singularity Container Image Format. The `siftool new` command and func siftool.New() produce predictable UUID identifiers due to insecure randomness in the version of the `github.com/satori/go.uuid` module used as a…

  sylabs sif singularity-container golang-github-sylabs-sif Debian Ubuntu Go
  May 7, 2021
• High 8.8
  CVE-2020-25040

  Insecure permissions on build temporary rootfs in Singularity

  Sylabs Singularity through 3.6.2 has Insecure Permissions on temporary directories used in explicit and implicit container build operations, a different vulnerability than CVE-2020-25039.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 8.1
  CVE-2020-25039

  Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

  Sylabs Singularity 3.2.0 through 3.6.2 has Insecure Permissions on temporary directories used in fakeroot or user namespace container execution.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Sep 16, 2020
• High 7.5
  CVE-2020-13846

  "Verify All" Returns Success Despite Validation Failures in Singularity

  Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2020-13845

  Execution Control List (ECL) Is Insecure in Singularity

  Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file…

  singularity-container singularity github.com/sylabs/singularity Ubuntu Alpine Go
  Jul 14, 2020
• High 7.5
  CVE-2020-8945

  GPGME Go wrapper contains Use After Free

  The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

  singularity-container golang-github-proglottis-gpgme github.com/proglottis/gpgme golang-github-proglottis-gpgme Debian Ubuntu Go
  Feb 12, 2020
• High 7.8
  CVE-2018-19295

  Sylabs Singularity Improper Input Validation

  Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.

  singularity-container github.com/sylabs/singularity Ubuntu Go
  Dec 17, 2018