There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a
    default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a
    `library://` URI will always attempt to retrieve the container from the default remote endpoint
    (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a
    malicious container to the default remote endpoint with a URI that is identical to the URI used by a
    victim with a non-default remote endpoint, thus executing the malicious container. Only action commands
    (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push`
    respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two
    possible workarounds exist: Users can only interact with the default remote endpoint, or an installation
    can have an execution control list configured to restrict execution to containers signed with specific
    secure keys. (CVE-2021-32635)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a     default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a     `library://` URI will always attempt to retrieve the container from the default remote endpoint     (`cloud.sylabs.io`) rather than the configured remote endpoint. An attacker may be able to push a     malicious container to the default remote endpoint with a URI that is identical to the URI used by a     victim with a non-default remote endpoint, thus executing the malicious container. Only action commands     (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push`     respect the configured remote endpoint. The vulnerability is patched in Singularity version 3.7.4. Two     possible workarounds exist: Users can only interact with the default remote endpoint, or an installation     can have an execution control list configured to restrict execution to containers signed with specific     secure keys. (CVE-2021-32635)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202107-50 (Singularity: Remote code execution)

    Singularity always uses the default remote endpoint,       &lsquo;cloud.syslabs.io&rsquo;, for action commands using the &lsquo;library://&rsquo;
      URI rather than the configured remote endpoint.
  Impact :

    An attacker that that can push a malicious container to the default       remote endpoint could execute code on hosts that fetch the container.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
400214	Alpine: singularity: security update to 3.7.3-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	8/16/2023	7/2/2026	medium
410932	SCA: security update for github.com/sylabs/singularity (GHSA-5mv9-q7fq-9394)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	medium
400214	Alpine: singularity: security update to 3.7.3-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	8/16/2023	7/2/2026	medium
426105	Alpine: multiple singularity packages: security update to 3.7.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	medium
410932	SCA: security update for github.com/sylabs/singularity (GHSA-5mv9-q7fq-9394)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	medium
426105	Alpine: multiple singularity packages: security update to 3.7.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	5/16/2025	7/2/2026	medium
248537	Linux Distros Unpatched Vulnerability : CVE-2021-32635	Nessus	Misc.	8/12/2025	7/12/2026	medium
156989	GLSA-202107-50 : Singularity: Remote code execution	Nessus	Gentoo Local Security Checks	1/24/2022	12/21/2023	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium