Vulnerability Details : CVE-2020-13847
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.
Products affected by CVE-2020-13847
- cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-13847
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-13847
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2020-13847
-
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-13847
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html
[security-announce] openSUSE-SU-2020:1011-1: important: Security updateBroken Link
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html
[security-announce] openSUSE-SU-2020:1100-1: important: Security updateBroken Link
-
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
[security-announce] openSUSE-SU-2020:1037-1: important: Security updateBroken Link
-
https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v
SIF Descriptor/Global Header Fields Not Signed · Advisory · hpcng/singularity · GitHubThird Party Advisory
-
https://medium.com/sylabs
Sylabs – MediumThird Party Advisory
Jump to