CVE-2020-13847 Other in n/a
Singularity fails to verify integrity of SIF file metadata, allowing attackers to bypass signature checks and potentially execute malicious containers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13847?
CVE-2020-13847 is a high-severity vulnerability in n/a, published on 14 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.
Weakness: CWE-354
Which versions are affected by CVE-2020-13847?
It affects 1 product.
Products include Sylabs Singularity.
How do I fix CVE-2020-13847?
Upgrade to a fixed version.
Is CVE-2020-13847 being exploited?
There is no known exploitation of CVE-2020-13847 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-m7j2-9565-4h9v, UBUNTU-CVE-2020-13847.