Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify     commands do not sign metadata found in the global header or data object descriptors of a SIF file.
    (CVE-2020-13847)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is
    not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the
    signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.
    (CVE-2020-13845)

  - Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code. (CVE-2020-13846)

  - Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify
    commands do not sign metadata found in the global header or data object descriptors of a SIF file.
    (CVE-2020-13847)

This update for singularity fixes the following issues :

  - New version 3.6.0. This version introduces a new     signature format for SIF images, and changes to the     signing / verification code to address the following     security problems :

  - CVE-2020-13845, boo#1174150 In Singularity 3.x versions     below 3.6.0, issues allow the ECL to be bypassed by a     malicious user.

  - CVE-2020-13846, boo#1174148 In Singularity 3.5 the --all     / -a option to singularity verify returns success even     when some objects in a SIF container are not signed, or     cannot be verified.

  - CVE-2020-13847, boo#1174152 In Singularity 3.x versions     below 3.6.0, Singularity's sign and verify commands do     not sign metadata found in the global header or data     object descriptors of a SIF file, allowing an attacker     to cause unexpected behavior. A signed container may     verify successfully, even when it has been modified in     ways that could be exploited to cause malicious     behavior.

  - New features / functionalities

  - A new '--legacy-insecure' flag to verify allows     verification of SIF signatures in the old, insecure     format.

  - A new '-l / --logs' flag for instance list that shows     the paths to instance STDERR / STDOUT log files.

  - The --json output of instance list now include paths to     STDERR / STDOUT log files.

  - Singularity now supports the execution of minimal     Docker/OCI containers that do not contain /bin/sh, e.g.
    docker://hello-world.

  - A new cache structure is used that is concurrency safe     on a filesystem that supports atomic rename. If you     downgrade to Singularity 3.5 or older after using 3.6     you will need to run singularity cache clean.

  - A plugin system rework adds new hook points that will     allow the development of plugins that modify behavior of     the runtime. An image driver concept is introduced for     plugins to support new ways of handling image and     overlay mounts. Plugins built for <=3.5 are not     compatible with 3.6.

  - The --bind flag can now bind directories from a SIF or     ext3 image into a container.

  - The --fusemount feature to mount filesystems to a     container via FUSE drivers is now a supported feature     (previously an experimental hidden flag).

  - This permits users to mount e.g. sshfs and cvmfs     filesystems to the container at runtime.

  - A new -c/--config flag allows an alternative     singularity.conf to be specified by the root user, or     all users in an unprivileged installation.

  - A new --env flag allows container environment variables     to be set via the Singularity command line.

  - A new --env-file flag allows container environment     variables to be set from a specified file.

  - A new --days flag for cache clean allows removal of     items older than a specified number of days. Replaces     the --name flag which is not generally useful as the     cache entries are stored by hash, not a friendly name.

  - Changed defaults / behaviours

  - New signature format (see security fixes above).

  - Fixed spacing of singularity instance list to be     dynamically changing based off of input lengths instead     of fixed number of spaces to account for long instance     names.

  - Environment variables prefixed with SINGULARITYENV_     always take precedence over variables without     SINGULARITYENV_ prefix.

  - The %post build section inherits environment variables     from the base image.

  - %files from ... will now follow symlinks for sources     that are directly specified, or directly resolved from a     glob pattern. It will not follow symlinks found through     directory traversal. This mirrors Docker multi-stage     COPY behaviour.

  - Restored the CWD mount behaviour of v2, implying that     CWD path is not recreated inside container and any     symlinks in the CWD path are not resolved anymore to     determine the destination path inside container.

  - The %test build section is executed the same manner as     singularity test image.

    --fusemount with the container: default directive will     foreground the FUSE process. Use container-daemon: for     previous behavior.

  - Deprecate -a / --all option to sign/verify as new     signature behavior makes this the default.

  - For more information about upstream changes, please     check:
    https://github.com/hpcng/singularity/blob/master/CHANGEL     OG.md

  - Removed --name flag for cache clean; replaced with
    --days.

ID	Name	Product	Family	Type	Severity
246160	Linux Distros Unpatched Vulnerability : CVE-2020-13847	Nessus	Misc.	Local	high
408117	Alpine: multiple singularity packages: security update to 3.6.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
408117	Alpine: multiple singularity packages: security update to 3.6.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
400332	Alpine: singularity: security update to 3.5.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
400332	Alpine: singularity: security update to 3.5.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
138979	openSUSE Security Update : singularity (openSUSE-2020-1037)	Nessus	SuSE Local Security Checks	Local	high
138673	openSUSE Security Update : singularity (openSUSE-2020-1011)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2020-13847

high

Tenable Plugins

high

high

high

high

high

high

high