CVE-2019-19724 Singularity insecure permissions

What is CVE-2019-19724?

CVE-2019-19724 is a high-severity vulnerability in n/a, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.

Weakness: CWE-276

Which versions are affected by CVE-2019-19724?

2 open source packages ship an affected version, including github.com/sylabs/singularity. It affects 1 product.

Products include Sylabs Singularity.

How do I fix CVE-2019-19724?

Upgrade github.com/sylabs/singularity to 3.5.2 or later.

Is CVE-2019-19724 being exploited?

There is no known exploitation of CVE-2019-19724 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2021-33027 Weak cryptography in n/a Critical 9.8
• CVE-2021-33622 Other in n/a Critical 9.8
• CVE-2018-19295 Sylabs Singularity Improper Input Validation High 7.8
• CVE-2020-13845 Execution Control List (ECL) Is Insecure in Singularity High 7.5
• CVE-2020-13846 "Verify All" Returns Success Despite Validation Failures in Singularity High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mj73-5x75-9phh, openSUSE-SU-2020:0057-1.