CVE-2020-13847

Published: Jul 14, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file.

Affected (1)

Products: Sylabs: Singularity

Sylabs

1 product

Singularity

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sylabs Singularity	From 3.0.0 to 3.5.0

Related CWEs

CWE-354

Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References (10)

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00053.html

Source: cve@mitre.org

Broken Link

https://github.com/hpcng/singularity/security/advisories/GHSA-m7j2-9565-4h9v

Source: cve@mitre.org

Third Party Advisory

https://medium.com/sylabs

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00046.html