SB2020072402 - OpenSUSE Linux update for singularity
Published: July 24, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-11328)
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions and allows authenticated users to edit files within the `/run/singularity/instances/sing//` directory. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
2) Incorrect default permissions (CVE-ID: CVE-2019-19724)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to insecure permissions for files and folders that are set by the application on $HOME/.singularity file when it is newly created by Singularity. A local user with access to the system can view contents of files and directories or modify them.
3) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2020-13845)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the image integrity is not validated when an ECL policy is enforced. A remote attacker can bypass implemented security restrictions.
4) Input validation error (CVE-ID: CVE-2020-13846)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due the affected software fails to report an error in a Status Code. A remote attacker can run arbitrary SIF containers that have unsigned, or modified, objects.
5) Improper validation of integrity check value (CVE-ID: CVE-2020-13847)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file. A remote attacker can cause unexpected behavior.
Remediation
Install update from vendor's website.