CVE-2022-39237 Digital Signature Hash Algorithms Not Validated in sylabs/sif

2022-10-0600:00:00

CWE-347

GitHub_M

www.cve.org

cve-2022-39237

sylabs/sif

digital signature

hash algorithms

upgrade

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

AI Score

9.7

Confidence

High

EPSS

0.002

Percentile

59.3%

JSON

syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the github.com/sylabs/sif/v2/pkg/integrity package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.

CNA Affected

[
  {
    "vendor": "sylabs",
    "product": "sif",
    "versions": [
      {
        "version": "< 2.8.1",
        "status": "affected"
      }
    ]
  }
]