SB2020072111 - OpenSUSE Linux update for singularity

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2020-13845)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the image integrity is not validated when an ECL policy is enforced. A remote attacker can bypass implemented security restrictions.

2) Input validation error (CVE-ID: CVE-2020-13846)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due the affected software fails to report an error in a Status Code. A remote attacker can run arbitrary SIF containers that have unsigned, or modified, objects.

3) Improper validation of integrity check value (CVE-ID: CVE-2020-13847)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file. A remote attacker can cause unexpected behavior.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html