CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2019-19724
High (7.5) in sylabs singularity. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in github.com/sylabs/singularity 3.5.2.
Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sylabs:singularity
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mj73-5x75-9phh | Go | github.com/sylabs/singularity | >=3.3.0 <3.5.2 | 3.5.2 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html
- https://github.com/sylabs/singularity/releases/tag/v3.5.2
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00059.html