CVE-2020-13845 : Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

Published 2020-07-14 18:15:14

Updated 2023-01-20 20:09:21

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-13845

Sylabs » Singularity
Versions from including (>=) 3.0.0 and up to, including, (<=) 3.5.0
cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-13845

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-13845

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:P/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2020-13845

CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Assigned by: nvd@nist.gov (Primary)
CWE-354 Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-13845

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html

[security-announce] openSUSE-SU-2020:1011-1: important: Security update
Broken Link

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html

[security-announce] openSUSE-SU-2020:1100-1: important: Security update
Broken Link

CVEs referencing this url
https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c

Execution Control List (ECL) Is Insecure · Advisory · hpcng/singularity · GitHub
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html

[security-announce] openSUSE-SU-2020:1037-1: important: Security update
Broken Link

CVEs referencing this url
https://medium.com/sylabs

Sylabs – Medium
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-13845

Products affected by CVE-2020-13845

Exploit prediction scoring system (EPSS) score for CVE-2020-13845

CVSS scores for CVE-2020-13845

CWE ids for CVE-2020-13845

References for CVE-2020-13845