CVE-2020-13845

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Improper Verification of Cryptographic Signature pada sylabs singularity. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value. Image integrity is not validated when an ECL policy is enforced. The fingerprint required by the ECL is compared against the signature object descriptor(s) in the SIF file, rather than to a cryptographically validated signature.

Rincian

Terbit di NVD

14 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-347: Improper Verification of Cryptographic Signature
CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/hpcng/singularity/security/advisories/GHSA-pmfr-63c2-jr5c advisory pihak ketiga
• https://medium.com/sylabs advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html broken link
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html broken link
• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html broken link