CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-39237
syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) used are cryptographically secure when verifying digital signatures. A patch is available in version >= v2.8.1 of the module. Users are encouraged to upgrade. Users unable to upgrade may independently validate that the hash algorithm(s) used for metadata digest(s) and signature hash are cryptographically secure.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-327, CWE-347
- Published
- Modified
- Record from
- the NVD, synced
Affected
- sylabs:singularity_image_format
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m5m3-46gj-wch8 | Go | github.com/sylabs/sif/v2 | <2.8.1 | 2.8.1 |
| GO-2022-1045 | Go | github.com/sylabs/sif/v2 | <2.8.1 | 2.8.1 |
References
- https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
- https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
- https://security.gentoo.org/glsa/202210-19
- https://github.com/sylabs/sif/commit/07fb86029a12e3210f6131e065570124605daeaa
- https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8