Singularity insecure permissions

Insecure permissions 777 are set on $HOME/.singularity when it is newly created by Singularity version from 3.3.0 to 3.5.1, which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services...

GHSA-MJ73-5X75-9PHH Singularity insecure permissions

Insecure permissions 777 are set on $HOME/.singularity when it is newly created by Singularity version from 3.3.0 to 3.5.1, which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services...

GHSA-P83V-8VMR-QFV9 Sylabs Singularity Improper Input Validation

Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks...

Singularity Incorrect Access Control

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features...

GHSA-4X32-H296-RG6J Singularity Incorrect Access Control

Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system. When using the overlay option, a malicious user may access sensitive information by exploiting a few specific Singularity features...

au.com.skytix:mesos-scheduler-client (>=1.0.11 <=1.0.15), au.com.skytix:velocity-scheduler (>=1.0.34 <=1.0.40) +40 more potentially affected by CVE-2017-7687 via org.apache.mesos:mesos (>=0.9.0-incubating <=1.1.2)

org.apache.mesos:mesos MAVEN version =0.9.0-incubating, =1.0.11, =1.0.34, =2.1.7, =2.1.7, =2.2.0, =2.2.0, =2.1.2, =2.1.2, =0.18.0, =0.1.3, =0.1.3, =0.18.0, =0.18.0, =0.18.0, =0.1.0, =0.2.0 and more Source cves: CVE-2017-7687 Source advisory: OSV:GHSA-X869-784M-JMJ2...

Privilege Escalation

singularity-container is vulnerable to privilege escalation. The vulnerability exists due to the singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file, allowing a malicious user to manipulate data without having a proper...

Business Logic Errors

Sylabs Singularity is vulnerable to business logic errors. The vulnerability exists because it fails to report an error in a Status Code which allows an attacker to cause an exploit...

Privilege Escalation

singularity-container is vulnerable to privilege escalation. The library contains an incorrect check of a function's return value, allowing attackers to gain elevated privileges...

Mageia: Security Advisory (MGASA-2022-0006)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-202107-50 : Singularity: Remote code execution

The remote host is affected by the vulnerability described in GLSA-202107-50 Singularity: Remote code execution Singularity always uses the default remote endpoint, cloud.syslabs.io, for action commands using the library:// URI rather than the configured remote endpoint. Impact : An attacker that...

MGASA-2022-0006 Updated singularity packages fix security vulnerability

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...

Updated singularity packages fix security vulnerability

A dependency used to extract docker/OCI image layers can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." or "/", when running as root. CVE-2021-29136 Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifyin...

[SECURITY] Fedora 35 Update: singularity-3.8.5-2.fc35

Singularity provides functionality to make portable containers that can be used across host environments...

[SECURITY] Fedora 34 Update: singularity-3.8.5-2.fc34

Singularity provides functionality to make portable containers that can be used across host environments...

Fedora: Security Advisory for singularity (FEDORA-2021-7333cffa91)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for singularity (FEDORA-2021-f6e491390b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

Impact Insecure permissions on temporary directories used in fakeroot or user namespace container execution. When a Singularity action command run, shell, exec is run with the fakeroot or user namespace option, Singularity will extract a container image to a temporary sandbox directory. Due to...

GHSA-W6V2-QCHM-GRJ7 Insecure permissions on user namespace / fakeroot temporary rootfs in Singularity

Impact Insecure permissions on temporary directories used in fakeroot or user namespace container execution. When a Singularity action command run, shell, exec is run with the fakeroot or user namespace option, Singularity will extract a container image to a temporary sandbox directory. Due to...

GHSA-557G-R22W-9WVX Incorrect Permission Assignment for Critical Resource in Singularity

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system e.g. ssh could exploit this vulnerability due to insecure permissions allowing a user to edit files within /run/singularity/instances/sing//. The manipulation of those files ca...